CVE-2021-46067 Cross-site scripting in n/a

What is CVE-2021-46067?

CVE-2021-46067 is a critical cross-site scripting vulnerability in n/a, published on 6 Jan 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Vehicle Service Management System 1.0 an attacker can steal the cookies leading to Full Account Takeover.

Which versions are affected by CVE-2021-46067?

It affects 1 product.

Products include Vehicle Service Management System Project Vehicle Service Management System.

How do I fix CVE-2021-46067?

No fix has been published for CVE-2021-46067 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2021-46067 being exploited?

There is no known exploitation of CVE-2021-46067 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2021-46076 File upload in n/a High 8.8
• CVE-2021-46075 Missing authorization in n/a High 7.2
• CVE-2021-46079 File upload in n/a High 7.2
• CVE-2023-2092 SourceCodester Vehicle Service Management System view_service.php sql injection Medium 6.3
• CVE-2023-2093 SourceCodester Vehicle Service Management System Login.php sql injection Medium 6.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-w33v-6wfx-hfw5.