Reflected Cross-Site Scripting Vulnerability in Purchase Order Management by Oretnom23
CVE-2023-29623

6.1MEDIUM

Key Information:

Vendor: Purchase Order Management Project
Status: Purchase Order Management
Vendor: CVE Published:; 14 April 2023

🔔 Create Purchase Order Management Project Vulnerability Alert

What is CVE-2023-29623?

A reflected cross-site scripting vulnerability has been identified in the Purchase Order Management application version 1.0. This flaw allows an attacker to exploit the application by sending a crafted request to the password parameter located at /purchase_order/classes/login.php. If a user interacts with this request, malicious scripts can be executed in their browser, leading to potential theft of sensitive information or session hijacking. This vulnerability emphasizes the need for robust input validation and security measures to prevent such exploitations.

References

https://portswigger.net/web-security/cross-site-scripting...

https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/mai...

CVSS V3.1

Score:

6.1

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

Low

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

None

User Interaction:

Required

Scope:

Changed

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Apr 14, 2023
Vulnerability Reserved
Apr 7, 2023

CVE-2023-29623 Data

JSON