PT-2023-23496 · Jizhicms · Jizhicms

Y0Ng · Published 2023-05-19 · Updated 2025-01-21 · CVE-2023-31862

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions jizhicms version 2.4.6

Description The issue allows attackers to publish an article containing malicious JavaScript scripts by modifying the request package, as the content of the article published in the front end is only filtered in the front end, without being filtered in the background.

Recommendations For jizhicms version 2.4.6, consider implementing backend filtering for article content to prevent Cross Site Scripting (XSS) attacks. As a temporary workaround, restrict the ability to publish articles containing JavaScript scripts until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-31862

Affected Products

Jizhicms

References · 5

• 🔥 https://github.com/Cherry-toto/jizhicms/issues/86 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-31862 · Security Note
• https://osv.dev/vulnerability/CVE-2023-31862 · Vendor Advisory
• https://t.me/cibsecurity/64461 · Telegram Post
• https://t.me/cvenotify/50811 · Telegram Post