PT-2023-27676 · Unknown · Phpgurukul User Registration & Login/User Management System With Admin Panel

Published 2023-10-16 · Updated 2023-10-20 · CVE-2023-40851

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Phpgurukul User Registration & Login and User Management System With admin panel version 3.0

Description The issue allows attackers to run arbitrary code via the fname, lname, email, and contact fields of the user registration page. This is a Cross Site Scripting (XSS) issue, which means attackers can inject malicious scripts into the website, potentially leading to unauthorized actions.

Recommendations For Phpgurukul User Registration & Login and User Management System With admin panel version 3.0, consider validating and sanitizing user input for the fname, lname, email, and contact fields to prevent malicious code injection. As a temporary workaround, restrict access to the user registration page until a patch is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-40851

Affected Products

Phpgurukul User Registration & Login/User Management System With Admin Panel

References · 5

• 🔥 https://exploit-db.com/exploits/51694 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-40851 · Security Note
• https://osv.dev/vulnerability/CVE-2023-40851 · Vendor Advisory
• https://twitter.com/CVEnew/status/1714018234951774279 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1714049702092480867 · Twitter Post