PT-2023-17374 · Unknown · Sourcecodester Online Computer/Laptop Store

Haicheng.Zhang · Publicado 2023-04-08 · Atualizado 2024-05-17 · CVE-2023-1961

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online Computer and Laptop Store version 1.0

Description A problematic issue has been found, affecting an unknown function of the file "/admin/?page=system info". The manipulation of the System Name argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling access to the "/admin/?page=system info" endpoint until a patch is available. Restrict the manipulation of the System Name argument to minimize the risk of cross-site scripting exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-1961

Produtos afetados

Sourcecodester Online Computer/Laptop Store

Referências · 6

• 🔥❌ https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Cross%20site%20scripting%20attack%20at%20system%20name%20setting.pdf · Exploit, Deleted
• https://vuldb.com/?ctiid.225348 · Nota
• https://t.me/cvenotify/47820 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-1961 · Aviso do Fabricante
• https://vuldb.com/?id.225348 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-1961 · Nota de Segurança