PT-2023-25232 · Unknown · Gz Scripts Php Crm Platform

Skalvin · Published 2023-07-08 · Updated 2024-05-17 · CVE-2023-3562

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GZ Scripts PHP CRM Platform version 1.8

Description A vulnerability has been found in the GZ Scripts PHP CRM Platform, classified as problematic. This issue affects unknown code of the file /index.php. The manipulation of the action argument leads to cross-site scripting. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

Recommendations For GZ Scripts PHP CRM Platform version 1.8, as a temporary workaround, consider restricting access to the /index.php file or disabling the manipulation of the action argument until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-3562

Affected Products

Gz Scripts Php Crm Platform

References · 6

• https://osv.dev/vulnerability/CVE-2023-3562 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-3562 · Security Note
• https://t.me/cvenotify/54428 · Telegram Post
• https://t.me/cibsecurity/66273 · Telegram Post
• https://vuldb.com/?ctiid.233356 · Note
• https://vuldb.com/?id.233356 · Note