PT-2023-26091 · Unknown · Maid Hiring Management System

Published 2023-07-13 · Updated 2023-11-14 · CVE-2023-37746

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Maid Hiring Management System version 1.0

Description A cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter of the "/admin/contactus.php" component.

Recommendations For Maid Hiring Management System version 1.0, consider disabling the /admin/contactus.php component until a patch is available, or restrict access to this component to minimize the risk of exploitation. Avoid using the Title parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-37746

Affected Products

Maid Hiring Management System

References · 5

• https://osv.dev/vulnerability/CVE-2023-37746 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-37746 · Security Note
• https://t.me/cvenotify/54865 · Telegram Post
• https://t.me/cvenotify/54279 · Telegram Post
• https://phpgurukul.com/maid-hiring-management-system-using-php-and-mysql · Note