Plataforma
php
Componente
online-courseware
Corrigido em
1.0.1
A problematic cross-site scripting (XSS) vulnerability has been identified in SourceCodester Online Courseware versions 1.0 through 1.0. This vulnerability allows attackers to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The affected component is the 'Edit Teacher' functionality within the /pcci/admin/saveeditt.php file. A patch is available in version 1.0.1.
Successful exploitation of CVE-2025-0800 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This could lead to the theft of sensitive information, such as session cookies, allowing the attacker to impersonate the user. The attacker could also modify the content of the web page, potentially defacing the site or redirecting users to malicious websites. Given the administrative context of the 'Edit Teacher' function, an attacker could potentially gain access to sensitive teacher data or modify course content.
This vulnerability has been publicly disclosed. While the CVSS score is LOW (2.4), the ease of exploitation and potential impact on user data warrant attention. No active exploitation campaigns or KEV listing have been reported as of the publication date (2025-01-29). Public proof-of-concept code is likely to emerge given the vulnerability's disclosure.
Administrators and teachers using SourceCodester Online Courseware version 1.0 are at direct risk. Shared hosting environments where multiple users share the same instance of the software are particularly vulnerable, as an attacker could potentially compromise the entire hosting environment through this vulnerability.
• php / web:
curl -I 'http://your-online-courseware-site.com/pcci/admin/saveeditt.php?fname=<script>alert(1)</script>' | grep -i '200'• php / web: Examine /pcci/admin/saveeditt.php for missing or inadequate input sanitization of the 'fname' parameter.
• generic web: Monitor access logs for unusual requests to /pcci/admin/saveeditt.php with suspicious parameters in the 'fname' field.
disclosure
Status do Exploit
EPSS
0.04% (percentil 11%)
CISA SSVC
Vetor CVSS
The primary mitigation for CVE-2025-0800 is to upgrade to SourceCodester Online Courseware version 1.0.1 or later, which contains the fix. If upgrading is not immediately possible, consider implementing input validation and sanitization on the 'fname' parameter within the /pcci/admin/saveeditt.php file to prevent malicious script injection. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review and restrict access to the /pcci/admin/saveeditt.php endpoint.
Actualice a una versión parcheada o desactive la funcionalidad Edit Teacher. Valide y escape las entradas del usuario en el parámetro 'fname' en el archivo saveeditt.php para prevenir la inyección de código malicioso. Implemente una política de seguridad de contenido (CSP) para mitigar los ataques XSS.
Análise de vulnerabilidades e alertas críticos diretamente no seu e-mail.
CVE-2025-0800 is a cross-site scripting (XSS) vulnerability affecting SourceCodester Online Courseware versions 1.0–1.0, allowing attackers to inject malicious scripts via the /pcci/admin/saveeditt.php file.
You are affected if you are using SourceCodester Online Courseware version 1.0. Upgrade to version 1.0.1 to resolve the vulnerability.
Upgrade to version 1.0.1 or later. As a temporary workaround, implement input validation and sanitization on the 'fname' parameter.
No active exploitation campaigns have been confirmed as of the publication date, but public proof-of-concept code is likely to emerge.
Refer to the SourceCodester website or their official communication channels for the advisory related to CVE-2025-0800.
Envie seu arquivo de dependências e descubra na hora se esta e outras CVEs te atingem.