PT-2023-25457 · Unknown · Sourcecodester Toll Tax Management System

Aftab Shaikh · Publicado 2023-08-03 · Atualizado 2025-02-24 · CVE-2023-36158

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions sourcecodester Toll Tax Management System version 1.0

Description The issue allows remote attackers to run arbitrary code via the First Name and Last Name fields on the "My Account" page. This is a Cross Site Scripting (XSS) issue, which means an attacker can inject malicious scripts into the website, potentially leading to unauthorized actions.

Recommendations For sourcecodester Toll Tax Management System version 1.0, consider validating and sanitizing user input for the First Name and Last Name fields to prevent malicious code injection. As a temporary workaround, restrict access to the "My Account" page until a proper fix is implemented.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-36158

Produtos afetados

Sourcecodester Toll Tax Management System

Referências · 8

• 🔥 https://github.com/unknown00759/CVE-2023-36158/blob/main/CVE-2023-36158.md · Exploit
• 🔥 https://cyberredteam.tech/posts/cve-2023-36158 · Exploit
• https://sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html · Nota
• https://t.me/cvenotify/112251 · Publicação no Telegram
• https://t.me/cibsecurity/67748 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-36158 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-36158 · Nota de Segurança
• http://toll.com · Nota