PT-2023-23503 · Unknown · Sourcecodester Online School Fees System

Zhangyf · Published 2023-06-14 · Updated 2024-05-17 · CVE-2023-3189

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Online School Fees System version 1.0

Description A problematic issue was found in the component POST Parameter Handler, affecting an unknown part of the file /paysystem/branch.php. The manipulation of the branch argument leads to cross-site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For version 1.0, consider disabling the branch argument in the /paysystem/branch.php file as a temporary workaround until a patch is available. Restrict access to the POST Parameter Handler component to minimize the risk of exploitation. Avoid using the branch argument in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-3189

Affected Products

Sourcecodester Online School Fees System

References · 8

• 🔥 https://github.com/M9KJ-TEAM/CVEReport/blob/main/XSS.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-3189 · Security Note
• https://osv.dev/vulnerability/CVE-2023-3189 · Vendor Advisory
• https://vuldb.com/?id.231501 · Note
• https://t.me/cvenotify/52291 · Telegram Post
• https://vuldb.com/?ctiid.231501 · Note
• https://t.me/cvenotify/52275 · Telegram Post
• https://t.me/cvenotify/52565 · Telegram Post