PT-2023-16971 · Sourcecodester · Sourcecodester Friendly Island Pizza Website/Ordering System

Jiaqi Yang · Published 2023-03-15 · Updated 2024-05-17 · CVE-2023-1418

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Friendly Island Pizza Website and Ordering System version 1.0

Description A problematic vulnerability was found in the file cashconfirm.php of the component POST Parameter Handler. The manipulation of the transactioncode argument leads to cross-site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the cashconfirm.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the transactioncode argument in the affected POST Parameter Handler to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1418

Affected Products

Sourcecodester Friendly Island Pizza Website/Ordering System

References · 7

• 🔥 https://github.com/2889436547/bug_report/blob/main/vendors/Skynidnine/Friendly%20Island%20Pizza%20Website%20and%20Ordering%20System/XSS-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-1418 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1418 · Security Note
• https://t.me/cvenotify/46540 · Telegram Post
• https://vuldb.com/?id.223129 · Note
• https://vuldb.com/?ctiid.223129 · Note
• https://t.me/cibsecurity/60067 · Telegram Post