PT-2023-29802 · Unknown · Code-Projects Blood Bank

Ersinerenler · Publicado 2023-11-13 · Atualizado 2023-11-16 · CVE-2023-46020

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code-Projects Blood Bank version 1.0

Description The issue allows attackers to run arbitrary code via the rename, remail, rphone, and rcity parameters in the "updateprofile.php" file. This can lead to the execution of malicious scripts.

Recommendations For Code-Projects Blood Bank version 1.0, consider validating and sanitizing the rename, remail, rphone, and rcity parameters in the "updateprofile.php" file to prevent arbitrary code execution. As a temporary workaround, restrict access to the "updateprofile.php" file until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46020

Produtos afetados

Code-Projects Blood Bank

Referências · 4

• 🔥 https://github.com/ersinerenler/CVE-2023-46020-Code-Projects-Blood-Bank-1.0-Stored-Cross-Site-Scripting-Vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2023-46020 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46020 · Nota de Segurança
• https://twitter.com/CVEnew/status/1724195574985998602 · Publicação no Twitter