PT-2023-29802 · Unknown · Code-Projects Blood Bank

Ersinerenler · Published 2023-11-13 · Updated 2023-11-16 · CVE-2023-46020

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Code-Projects Blood Bank version 1.0

Description The issue allows attackers to run arbitrary code via the rename, remail, rphone, and rcity parameters in the "updateprofile.php" file. This can lead to the execution of malicious scripts.

Recommendations For Code-Projects Blood Bank version 1.0, consider validating and sanitizing the rename, remail, rphone, and rcity parameters in the "updateprofile.php" file to prevent arbitrary code execution. As a temporary workaround, restrict access to the "updateprofile.php" file until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46020

Affected Products

Code-Projects Blood Bank

References · 4

• 🔥 https://github.com/ersinerenler/CVE-2023-46020-Code-Projects-Blood-Bank-1.0-Stored-Cross-Site-Scripting-Vulnerability · Exploit
• https://osv.dev/vulnerability/CVE-2023-46020 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46020 · Security Note
• https://twitter.com/CVEnew/status/1724195574985998602 · Twitter Post