CVE-2020-10429

EUVD-2020-2882 · Published Mar 12, 2020

The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS (injecting arbitrary web script or HTML) in admin/manage-settings.php by adding a question mark (?) followed by the payload.

Technologies

Chadhaajay Phpkb

Weaknesses

CWE-79

CVSS scores

v3.14.8CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
v2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access

T1190Exploit Public-Facing Application

References

http://antoniocannito.it/?p=137#uxss
https://antoniocannito.it/phpkb1#reflected-cross-site-scripting-in-every-admin-page-cve-block-going-from-cve-2020-10391-to-cve-2020-10456

Potentially impacted assets

See if this affects your attack surface