PT-2023-17374 · Unknown · Sourcecodester Online Computer/Laptop Store

Haicheng.Zhang · Published 2023-04-08 · Updated 2024-05-17 · CVE-2023-1961

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online Computer and Laptop Store version 1.0

Description A problematic issue has been found, affecting an unknown function of the file "/admin/?page=system info". The manipulation of the System Name argument leads to cross-site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling access to the "/admin/?page=system info" endpoint until a patch is available. Restrict the manipulation of the System Name argument to minimize the risk of cross-site scripting exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-1961

Affected Products

Sourcecodester Online Computer/Laptop Store

References · 6

• 🔥❌ https://github.com/boyi0508/Online-Computer-and-Laptop-Store/blob/main/Cross%20site%20scripting%20attack%20at%20system%20name%20setting.pdf · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2023-1961 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-1961 · Security Note
• https://vuldb.com/?ctiid.225348 · Note
• https://t.me/cvenotify/47820 · Telegram Post
• https://vuldb.com/?id.225348 · Note