PT-2023-5660 · Unknown · Blood Bank & Donor Management

Soundar M · Published 2023-09-08 · Updated 2023-11-14 · CVE-2023-41575

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Blood Bank & Donor Management version 2.2

Description The issue concerns multiple stored cross-site scripting (XSS) vulnerabilities in the /bbdms/sign-up.php file. These vulnerabilities allow attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Full Name, Message, or Address parameters. This can be exploited by a remote attacker to conduct a cross-site scripting attack.

Recommendations For Blood Bank & Donor Management version 2.2, consider disabling the /bbdms/sign-up.php file or restricting access to it until a patch is available. As a temporary workaround, avoid using the Full Name, Message, or Address parameters in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2023-06327

CVE-2023-41575

Affected Products

Blood Bank & Donor Management

References · 8

• 🔥 https://github.com/soundarkutty/Stored-xss/blob/main/poc · Exploit
• https://osv.dev/vulnerability/CVE-2023-41575 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41575 · Security Note
• https://bdu.fstec.ru/vul/2023-06327 · Security Note
• https://twitter.com/CVEnew/status/1700220889126629411 · Twitter Post
• https://vuldb.com/?id.239266 · Note
• https://twitter.com/VulmonFeeds/status/1700249138338619863 · Twitter Post
• https://t.me/cibsecurity/70161 · Telegram Post