PT-2023-19158 · Sourcecodester · Sourcecodester Online Dj Management System

Yohane · Publicado 2023-04-28 · Atualizado 2024-05-17 · CVE-2023-2372

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online DJ Management System version 1.0

Description A problematic issue has been found in the system, affecting some unknown functionality of the file classes/Master.php?f=save event. The manipulation of the name argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the functionality related to the classes/Master.php?f=save event file until a patch is available. Restrict access to this file to minimize the risk of exploitation. Avoid using the name argument in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2372

Produtos afetados

Sourcecodester Online Dj Management System

Referências · 6

• 🔥 https://github.com/yoyoyoyoyohane/bug_report/blob/main/XSS-1.md · Exploit
• https://vuldb.com/?ctiid.227648 · Nota
• https://t.me/cibsecurity/63057 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2372 · Aviso do Fabricante
• https://vuldb.com/?id.227648 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-2372 · Nota de Segurança