PT-2023-20842 · Sourcecodester · Sourcecodester Personnel Property Equipment System

Leozhangca · Publicado 2023-05-14 · Atualizado 2024-05-17 · CVE-2023-2691

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Personnel Property Equipment System version 1.0

Description A problematic vulnerability was found in the SourceCodester Personnel Property Equipment System. The issue affects an unknown function of the file admin/add item.php, specifically the component POST Parameter Handler. The manipulation of the item name argument leads to cross-site scripting. This attack can be launched remotely.

Recommendations For version 1.0, consider disabling the item name argument in the POST Parameter Handler until a patch is available. Restrict access to the admin/add item.php file to minimize the risk of exploitation. Avoid using the item name argument in the affected component until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-2691

Produtos afetados

Sourcecodester Personnel Property Equipment System

Referências · 7

• 🔥 https://github.com/LeozhangCA/CVEReport/blob/main/StoredXSS.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-2691 · Nota de Segurança
• https://t.me/cvenotify/50395 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-2691 · Aviso do Fabricante
• https://t.me/cibsecurity/64071 · Publicação no Telegram
• https://vuldb.com/?id.228972 · Nota
• https://vuldb.com/?ctiid.228972 · Nota