PT-2023-32344 · Unknown · Flusity-Cms

Zihe · Publicado 2023-10-27 · Atualizado 2024-05-17 · CVE-2023-5810

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Média

Vetor base

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions flusity CMS (affected versions not specified)

Description A problematic issue has been found in flusity CMS, affecting the loadPostAddForm function of the file core/tools/posts.php. The manipulation of the edit post id argument leads to cross-site scripting. The attack may be initiated remotely.

Recommendations To fix this issue, it is recommended to apply a patch. As a temporary workaround, consider disabling the loadPostAddForm function until a patch is available. Restrict access to the core/tools/posts.php file to minimize the risk of exploitation. Avoid using the edit post id argument in the affected function until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2023-5810

Produtos afetados

Flusity-Cms

Referências · 6

• 🔥 https://github.com/flusity/flusity-CMS/issues/2 · Exploit
• https://github.com/flusity/flusity-CMS/commit/6943991c62ed87c7a57989a0cb7077316127def8 · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2023-5810 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-5810 · Aviso do Fabricante
• https://vuldb.com/?ctiid.243641 · Nota
• https://vuldb.com/?id.243641 · Nota