PT-2023-16971 · Sourcecodester · Sourcecodester Friendly Island Pizza Website/Ordering System

Jiaqi Yang · Publicado 2023-03-15 · Atualizado 2024-05-17 · CVE-2023-1418

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Friendly Island Pizza Website and Ordering System version 1.0

Description A problematic vulnerability was found in the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the transactioncode argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the cashconfirm.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the transactioncode argument in the affected POST Parameter Handler to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-1418

Produtos afetados

Sourcecodester Friendly Island Pizza Website/Ordering System

Referências · 7

• 🔥 https://github.com/2889436547/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/XSS-1.md · Exploit
• https://t.me/cvenotify/46540 · Publicação no Telegram
• https://vuldb.com/?id.223129 · Nota
• https://osv.dev/vulnerability/CVE-2023-1418 · Aviso do Fabricante
• https://vuldb.com/?ctiid.223129 · Nota
• https://t.me/cibsecurity/60067 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-1418 · Nota de Segurança