PT-2023-17465 · Eyoucms · Eyoucms

Wwesleywww · Publicado 2023-04-14 · Atualizado 2024-05-17 · CVE-2023-2057

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EyouCms version 1.5.4

Description A problematic issue was found in the New Picture Handler component, specifically in the file login.php, where an unknown function is affected. The manipulation of the litpic loca argument leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For EyouCms version 1.5.4, consider disabling the litpic loca argument in the login.php file until a patch is available. Restrict access to the New Picture Handler component to minimize the risk of exploitation. Avoid using the litpic loca argument in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2057

Produtos afetados

Eyoucms

Referências · 6

• 🔥 https://github.com/sleepyvv/vul_report/blob/main/EYOUCMS/XSS1.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-2057 · Aviso do Fabricante
• https://t.me/cibsecurity/62154 · Publicação no Telegram
• https://vuldb.com/?id.225942 · Nota
• https://vuldb.com/?ctiid.225942 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2057 · Nota de Segurança