PT-2023-32726 · Sourcecodester · Sourcecodester Simple Invoice Generator System

Xuzisen · Published 2023-12-10 · Updated 2024-05-17 · CVE-2023-6650

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Invoice Generator System version 1.0

Description A vulnerability was found in the system, classified as problematic, affecting some unknown processing of the file login.php. The manipulation of the cashier argument leads to cross-site scripting. The attack may be initiated remotely.

Recommendations For version 1.0, consider disabling the cashier argument in the login.php file as a temporary workaround until a patch is available. Restrict access to the login.php file to minimize the risk of exploitation. Avoid using the cashier argument in the affected processing until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2023-6650

Affected Products

Sourcecodester Simple Invoice Generator System

References · 7

• 🔥 https://github.com/x1280/CVE/blob/main/Cross-site%20Scriping_cashier.md · Exploit
• https://osv.dev/vulnerability/CVE-2023-6650 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-6650 · Security Note
• https://vuldb.com/?id.247343 · Note
• https://twitter.com/VulmonFeeds/status/1733841410200117265 · Twitter Post
• https://vuldb.com/?ctiid.247343 · Note
• https://twitter.com/CVEnew/status/1733799073671749758 · Twitter Post