PT-2023-27676 · Unknown · Phpgurukul User Registration & Login/User Management System With Admin Panel

CVE-2023-40851 · Publicado 2023-10-16 · Atualizado 2023-10-20

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Phpgurukul User Registration & Login and User Management System With admin panel version 3.0

Description The issue allows attackers to run arbitrary code via the fname, lname, email, and contact fields of the user registration page. This is a Cross Site Scripting (XSS) issue, which means attackers can inject malicious scripts into the website, potentially leading to unauthorized actions.

Recommendations For Phpgurukul User Registration & Login and User Management System With admin panel version 3.0, consider validating and sanitizing user input for the fname, lname, email, and contact fields to prevent malicious code injection. As a temporary workaround, restrict access to the user registration page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-40851

Produtos afetados

Phpgurukul User Registration & Login/User Management System With Admin Panel

Referências · 5

• 🔥 https://exploit-db.com/exploits/51694 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40851 · Nota de Segurança
• https://twitter.com/CVEnew/status/1714018234951774279 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2023-40851 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1714049702092480867 · Publicação no Twitter