PT-2023-20773 · Sourcecodester · Sourcecodester Lost/Found Information System

Huutuanbg97 · Published 2023-05-12 · Updated 2024-05-17 · CVE-2023-2671

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Lost and Found Information System version 1.0

Description A problematic issue affects the Contact Form component, specifically the file classes/Master.php?f=save inquiry. The manipulation of the fullname, contact, or message arguments leads to cross-site scripting. This issue can be initiated remotely.

Recommendations For SourceCodester Lost and Found Information System version 1.0, consider disabling the Contact Form component until a patch is available. Restrict access to the classes/Master.php file to minimize the risk of exploitation. Avoid using the fullname, contact, and message arguments in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-2671

Affected Products

Sourcecodester Lost/Found Information System

References · 6

• 🔥 https://github.com/tht1997/CVE_2023/blob/main/Lost%20and%20Found%20Information%20System/CVE-2023-2671.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-2671 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-2671 · Security Note
• https://vuldb.com/?id.228887 · Note
• https://vuldb.com/?ctiid.228887 · Note
• https://t.me/cvenotify/50794 · Telegram Post