CVE-2024-33984

Name of the Vulnerable Software and Affected Versions School Attendance Monitoring System and School Event Management System version 1.0

Description A Cross-Site Scripting (XSS) issue affects the system, allowing an attacker to create a specially crafted URL and send it to a victim. This could lead to the obtainment of details of their session cookie via the Attendance, attenddate, and YearLevel parameters in the "/AttendanceMonitoring/report/index.php" endpoint.

Recommendations For version 1.0, consider disabling the "/AttendanceMonitoring/report/index.php" endpoint until a patch is available, or restrict access to the Attendance, attenddate, and YearLevel parameters to minimize the risk of exploitation.