PT-2023-25457 · Unknown · Sourcecodester Toll Tax Management System

Aftab Shaikh · Published 2023-08-03 · Updated 2025-02-24 · CVE-2023-36158

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions sourcecodester Toll Tax Management System version 1.0

Description The issue allows remote attackers to run arbitrary code via the First Name and Last Name fields on the "My Account" page. This is a Cross Site Scripting (XSS) issue, which means an attacker can inject malicious scripts into the website, potentially leading to unauthorized actions.

Recommendations For sourcecodester Toll Tax Management System version 1.0, consider validating and sanitizing user input for the First Name and Last Name fields to prevent malicious code injection. As a temporary workaround, restrict access to the "My Account" page until a proper fix is implemented.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36158

Affected Products

Sourcecodester Toll Tax Management System

References · 8

• 🔥 https://github.com/unknown00759/CVE-2023-36158/blob/main/CVE-2023-36158.md · Exploit
• 🔥 https://cyberredteam.tech/posts/cve-2023-36158 · Exploit
• https://osv.dev/vulnerability/CVE-2023-36158 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-36158 · Security Note
• https://sourcecodester.com/php/15304/toll-tax-management-system-phpoop-free-source-code.html · Note
• https://t.me/cvenotify/112251 · Telegram Post
• https://t.me/cibsecurity/67748 · Telegram Post
• http://toll.com · Note