PT-2023-20773 · Sourcecodester · Sourcecodester Lost/Found Information System

Huutuanbg97 · Publicado 2023-05-12 · Atualizado 2024-05-17 · CVE-2023-2671

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Lost and Found Information System version 1.0

Description A problematic issue affects the Contact Form component, specifically the file classes/Master.php?f=save inquiry. The manipulation of the fullname, contact, or message arguments leads to cross-site scripting. This issue can be initiated remotely.

Recommendations For SourceCodester Lost and Found Information System version 1.0, consider disabling the Contact Form component until a patch is available. Restrict access to the classes/Master.php file to minimize the risk of exploitation. Avoid using the fullname, contact, and message arguments in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2671

Produtos afetados

Sourcecodester Lost/Found Information System

Referências · 6

• 🔥 https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2671.md · Exploit
• https://vuldb.com/?id.228887 · Nota
• https://vuldb.com/?ctiid.228887 · Nota
• https://osv.dev/vulnerability/CVE-2023-2671 · Aviso do Fabricante
• https://t.me/cvenotify/50794 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-2671 · Nota de Segurança