Sanoma Clickedu Reflected Cross-Site Scripting Vulnerability

A reflected Cross-Site Scripting (XSS) vulnerability exists in Sanoma's Clickedu school management platform, affecting versions prior to 5.1. This vulnerability allows attackers to execute JavaScript in the victim's browser by sending a malicious URL through the '/user.php/' endpoint. Exploitation could lead to the theft of sensitive user information, such as session cookies, or allow actions to be performed on behalf of the user.

Impact

Exploitation of this vulnerability allows for reflected Cross-Site Scripting, where an attacker can execute scripts in the context of the user's browser session.

Remediation

Users can upgrade to Clickedu version 5.1 to address this vulnerability.