PT-2023-25485 · Xoops Cms · Xoops Cms

Published 2023-08-03 · Updated 2023-08-08 · CVE-2023-36217

Positive Technologies (AI Summary)

CVSS v3.1

9.0

Critical

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Xoops CMS version 2.5.10

Description A Cross Site Scripting issue allows a remote attacker to execute arbitrary code via the category name field of the image manager function. This enables the attacker to inject malicious scripts into the website, potentially leading to unauthorized access or data theft.

Recommendations For Xoops CMS version 2.5.10, consider disabling the image manager function until a patch is available to prevent exploitation of the Cross Site Scripting issue. Restrict access to the category name field to minimize the risk of arbitrary code execution.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-36217

Affected Products

Xoops Cms

References · 5

• 🔥 https://exploit-db.com/exploits/51520 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-36217 · Security Note
• https://osv.dev/vulnerability/CVE-2023-36217 · Vendor Advisory
• https://github.com/XOOPS/XoopsCore25/releases/tag/v2.5.10 · Note
• https://t.me/cibsecurity/67721 · Telegram Post