PT-2023-26710 · Badaso · Badaso

Anh91 · Publicado 2023-08-30 · Atualizado 2023-09-01 · CVE-2023-38970

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Badaso versions 0.0.1 through 2.9.7

Description The issue allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function. This enables the execution of arbitrary code, potentially leading to further malicious activities.

Recommendations For Badaso versions 0.0.1 through 2.9.7, consider restricting access to the add new member function until a patch is available. As a temporary workaround, avoid using the Name of member parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-38970

GHSA-7422-7RQ6-J4QV

Produtos afetados

Badaso

Referências · 7

• 🔥 https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md · Exploit
• 🔥 https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-new-member · Exploit
• https://github.com/uasoft-indonesia/badaso · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2023-38970 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-7422-7rq6-j4qv · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2023-38970 · Aviso do Fabricante
• https://t.me/cibsecurity/69497 · Publicação no Telegram