PT-2023-17465 · Eyoucms · Eyoucms

Wwesleywww · Published 2023-04-14 · Updated 2024-05-17 · CVE-2023-2057

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions EyouCms version 1.5.4

Description A problematic issue was found in the New Picture Handler component, specifically in the file login.php, where an unknown function is affected. The manipulation of the litpic loca argument leads to cross-site scripting. This issue can be exploited remotely.

Recommendations For EyouCms version 1.5.4, consider disabling the litpic loca argument in the login.php file until a patch is available. Restrict access to the New Picture Handler component to minimize the risk of exploitation. Avoid using the litpic loca argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2057

Affected Products

Eyoucms

References · 6

• 🔥 https://github.com/sleepyvv/vul_report/blob/main/EYOUCMS/XSS1.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-2057 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2057 · Security Note
• https://t.me/cibsecurity/62154 · Telegram Post
• https://vuldb.com/?id.225942 · Note
• https://vuldb.com/?ctiid.225942 · Note