PT-2023-29787 · Unknown · I-Doit Pro

Leekenghwa · Publicado 2023-10-21 · Atualizado 2024-09-11 · CVE-2023-46003

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions i-doit pro versions 25 and below

Description The issue is related to Cross Site Scripting (XSS) and can be exploited via the index.php endpoint. This allows for potential malicious script injection.

Recommendations For versions 25 and below, consider disabling access to the index.php endpoint until a fix is available. As a temporary workaround, restrict the use of user-inputted data in the index.php endpoint to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46003

Produtos afetados

I-Doit Pro

Referências · 9

• 🔥 https://medium.com/@ray.999/stored-xss-in-i-doit-pro-25-and-below-cve-2023-46003-17fb8d6fe2e9 · Exploit
• 🔥 https://github.com/leekenghwa/CVE-2023-46003 · Exploit
• https://medium.com/%40ray.999/stored-xss-in-i-doit-pro-25-and-below-cve-2023-46003-17fb8d6fe2e9 · Nota
• https://t.me/cvenotify/59869 · Publicação no Telegram
• https://t.me/cvenotify/94249 · Publicação no Telegram
• https://t.me/cvenotify/59874 · Publicação no Telegram
• https://i-doit.com · Nota
• https://osv.dev/vulnerability/CVE-2023-46003 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46003 · Nota de Segurança