PT-2023-30098 · Unknown · Inventory Management

Ersinerenler · Publicado 2023-11-14 · Atualizado 2023-11-17 · CVE-2023-46580

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Média

Vetor base

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Inventory Management version V1.0

Description A Cross-Site Scripting (XSS) issue allows attackers to execute arbitrary code via the pname parameter of the "editProduct.php" component.

Recommendations For Inventory Management version V1.0, consider restricting access to the pname parameter in the editProduct.php component until a patch is available. As a temporary workaround, avoid using the pname parameter in the affected component to minimize the risk of exploitation.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-46580

Produtos afetados

Inventory Management

Referências · 3

• 🔥 https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46580-Code-Projects-Inventory-Management-1.0-Stored-Cross-Site-Scripting-Vulnerability.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-46580 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-46580 · Nota de Segurança