PT-2023-23503 · Unknown · Sourcecodester Online School Fees System

Zhangyf · Publicado 2023-06-14 · Atualizado 2024-05-17 · CVE-2023-3189

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online School Fees System version 1.0

Description A problematic issue was found in the component POST Parameter Handler, affecting an unknown part of the file /paysystem/branch.php. The manipulation of the branch argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the branch argument in the /paysystem/branch.php file as a temporary workaround until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the branch argument in the affected API endpoint until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-3189

Produtos afetados

Sourcecodester Online School Fees System

Referências · 8

• 🔥 https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS.md · Exploit
• https://vuldb.com/?id.231501 · Nota
• https://t.me/cvenotify/52291 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2023-3189 · Nota de Segurança
• https://vuldb.com/?ctiid.231501 · Nota
• https://t.me/cvenotify/52275 · Publicação no Telegram
• https://t.me/cvenotify/52565 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-3189 · Aviso do Fabricante