PT-2023-29787 · Unknown · I-Doit Pro

Leekenghwa · Published 2023-10-21 · Updated 2024-09-11 · CVE-2023-46003

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions i-doit pro versions 25 and below

Description The issue is related to Cross Site Scripting (XSS) and can be exploited via the index.php endpoint. This allows for potential malicious script injection.

Recommendations For versions 25 and below, consider disabling access to the index.php endpoint until a fix is available. As a temporary workaround, restrict the use of user-inputted data in the index.php endpoint to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46003

Affected Products

I-Doit Pro

References · 9

• 🔥 https://medium.com/@ray.999/stored-xss-in-i-doit-pro-25-and-below-cve-2023-46003-17fb8d6fe2e9 · Exploit
• 🔥 https://github.com/leekenghwa/CVE-2023-46003 · Exploit
• https://osv.dev/vulnerability/CVE-2023-46003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46003 · Security Note
• https://medium.com/%40ray.999/stored-xss-in-i-doit-pro-25-and-below-cve-2023-46003-17fb8d6fe2e9 · Note
• https://t.me/cvenotify/59869 · Telegram Post
• https://t.me/cvenotify/94249 · Telegram Post
• https://t.me/cvenotify/59874 · Telegram Post
• https://i-doit.com · Note