POC详情： 887552aae899f47f975cc4ae61a407674123030c

来源
https://github.com/geraldoalcantara/CVE-2023-51802
关联漏洞
标题： Simple Student Attendance System 安全漏洞 (CVE-2023-51802)
描述：Simple Student Attendance System是一个简单的学生考勤系统。 Simple Student Attendance System v.1.0 版本存在安全漏洞。攻击者利用该漏洞通过特制的载荷对 /php-attendance/attendance_report 组件中的 page 或 class_month 参数执行任意代码。
描述
Simple Student Attendance System v.1.0 - Cross-site scripting (XSS) vulnerabilities in attendance_report
介绍
# CVE-2023-51802
# Simple Student Attendance System v.1.0 - Cross-site scripting (XSS) vulnerabilities in attendance_report

**Description**: > Cross Site Scripting vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted payload to the "page" or "class_month" parameter in the attendance_report component.
 

**Vulnerable Product Version**: Simple Student Attendance System v.1.0  
**CVE Author**: Geraldo Alcântara  
**Date**: 28/11/2023  
**Confirmed on**: 10/01/2024  
**CVE**: CVE-2023-51802  
**CVE Link**: https://www.cve.org/CVERecord?id=CVE-2023-51802  
**NVD Link**: https://nvd.nist.gov/vuln/detail/CVE-2023-51802  
**Tenable Link**: https://www.tenable.com/cve/CVE-2023-51802  
**Tested on**: Windows   
### Steps to reproduce:  
To exploit this vulnerability, an attacker needs to access the '/php-attendance/attendance_report' page. During a search, the attacker can manipulate the vulnerable parameters passed via the URL with a malicious payload.   
**Affected Components**:   
> attendance_report - page and class_month parameters  
### Request:  
```
Payload:page=attendance_report&class_id=1&class_month=jgarv%22%3e%3cscript%3ealert(1)%3c%2fscript%3ehrldm
```
Discoverer(s)/Credits:  
Geraldo Alcântara
文件快照

 [4.0K]  /data/pocs/887552aae899f47f975cc4ae61a407674123030c
└── [1.3K]  README.md

0 directories, 1 file
神龙机器人已为您缓存
备注
    1. 建议优先通过来源进行访问。
    2. 如果因为来源失效或无法访问，请发送邮箱到 f.jinxu#gmail.com 索取本地快照（把 # 换成 @）。
    3. 神龙已为您对POC代码进行快照，为了长期维护，请考虑为本地POC付费，感谢您的支持。