PT-2023-30098 · Unknown · Inventory Management

Ersinerenler · Published 2023-11-14 · Updated 2023-11-17 · CVE-2023-46580

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Inventory Management version V1.0

Description A Cross-Site Scripting (XSS) issue allows attackers to execute arbitrary code via the pname parameter of the "editProduct.php" component.

Recommendations For Inventory Management version V1.0, consider restricting access to the pname parameter in the editProduct.php component until a patch is available. As a temporary workaround, avoid using the pname parameter in the affected component to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-46580

Affected Products

Inventory Management

References · 3

• 🔥 https://github.com/ersinerenler/Code-Projects-Inventory-Management-1.0/blob/main/CVE-2023-46580-Code-Projects-Inventory-Management-1.0-Stored-Cross-Site-Scripting-Vulnerability.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-46580 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-46580 · Security Note