Jekyll2025-06-30T19:56:57+00:00https://panagiotiscp.github.io/feed.xmlYour NameWeb Developer from SomewhereCVE‑2024‑31026 – HTML Injection in GUnet Open eClass2024-03-24T00:00:00+00:002024-03-24T00:00:00+00:00https://panagiotiscp.github.io/cve-2024-31026-html-injectionDate of Report: 24 / 3 / 2024

Description

GUnet Open eClass ≤ 3.15 is vulnerable to HTML injection via the chat input field inside any course module.

Impact

Attackers can:

  • Inject deceptive content or phishing pages
  • Auto‑redirect users to malicious sites
  • Seed malware downloads

Proof of Concept

https://www.youtube.com/watch?v=-DwkPVmTrfY

Affected Component

chat input field (modules/chat/).

Mitigation

Escape or strip HTML, or render chat content with a whitelist sanitizer.

]]>CVE‑2024‑31027 – Stored XSS via User Registration Fields2024-03-24T00:00:00+00:002024-03-24T00:00:00+00:00https://panagiotiscp.github.io/cve-2024-31027-stored-xss-user-infoDate of Report: 24 / 3 / 2024

Description

Attackers can register accounts whose first name, last name, or username contain malicious scripts.
These payloads execute later when admins search or list users.

Impact

  • Admin session hijack & privilege escalation
  • System‑wide malware injection
  • Data exfiltration

Proof of Concept

https://www.youtube.com/watch?v=7_0WgRv_sok

Affected Component

User registration logic (modules/auth/). Admin panel logic (modules/admin/).

Mitigation

Sanitize/encode user attributes before storage and when rendering.

]]>You’re up and running!2014-03-03T00:00:00+00:002014-03-03T00:00:00+00:00https://panagiotiscp.github.io/Hello-WorldNext you can update your site name, avatar and other options using the _config.yml file in the root of your repository (shown below).

_config.yml

The easiest way to make your first post is to edit this one. Go into /_posts/ and update the Hello World markdown file. For more instructions head over to the Jekyll Now repository on GitHub.

]]>