PT-2023-23470 · Unknown · It Sourcecode Content Management System Project In Php/Mysql With Source Code

Tzssz · Published 2023-05-22 · Updated 2023-05-30 · CVE-2023-31816

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions IT Sourcecode Content Management System Project In PHP and MySQL With Source Code version 1.0.0

Description The issue concerns a Cross Site Scripting (XSS) vulnerability. This vulnerability can be exploited via the "/ecodesource/search list.php" API endpoint. Cross Site Scripting (XSS) is a type of security vulnerability that occurs when an attacker is able to inject malicious scripts into a website, which are then executed by the user's browser. This can allow the attacker to steal user data, take control of the user's session, or perform other malicious actions.

Recommendations For IT Sourcecode Content Management System Project In PHP and MySQL With Source Code version 1.0.0, as a temporary workaround, consider restricting access to the "/ecodesource/search list.php" endpoint until a patch is available. Avoid using this endpoint in a way that could allow an attacker to inject malicious scripts. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-31816

Affected Products

It Sourcecode Content Management System Project In Php/Mysql With Source Code

References · 4

• 🔥 https://github.com/TzssZ/Content-Management-System-v1.0-has-Cross-site-Scripting-XSS- · Exploit
• https://osv.dev/vulnerability/CVE-2023-31816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-31816 · Security Note
• https://t.me/cibsecurity/64570 · Telegram Post