PT-2023-26710 · Badaso · Badaso

Anh91 · Published 2023-08-30 · Updated 2023-09-01 · CVE-2023-38970

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Badaso versions 0.0.1 through 2.9.7

Description The issue allows a remote attacker to execute arbitrary code via a crafted payload to the Name of member parameter in the add new member function. This enables the execution of arbitrary code, potentially leading to further malicious activities.

Recommendations For Badaso versions 0.0.1 through 2.9.7, consider restricting access to the add new member function until a patch is available. As a temporary workaround, avoid using the Name of member parameter in the affected function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-38970

GHSA-7422-7RQ6-J4QV

Affected Products

Badaso

References · 7

• 🔥 https://github.com/anh91/uasoft-indonesia--badaso/blob/main/XSS3.md · Exploit
• 🔥 https://panda002.hashnode.dev/badaso-version-297-has-an-xss-vulnerability-in-new-member · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-38970 · Security Note
• https://osv.dev/vulnerability/GHSA-7422-7rq6-j4qv · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-38970 · Vendor Advisory
• https://github.com/uasoft-indonesia/badaso · Note
• https://t.me/cibsecurity/69497 · Telegram Post