Cross Site Scripting Vulnerability in Lost and Found Information System by Sourcecodester
CVE-2023-36159

6.1MEDIUM

Key Information:

Vendor

Oretnom23

Status
Lost And Found Information System
Vendor
CVE Published:
4 August 2023

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2023-36159?

The Lost and Found Information System by Sourcecodester is susceptible to a Cross Site Scripting (XSS) vulnerability. This security flaw allows remote attackers to execute arbitrary code by manipulating the First Name, Middle Name, and Last Name fields on the Create User page. Such an exploit could lead to unauthorized access to sensitive user data, making it imperative for users of this system to implement necessary security patches and best practices.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2023-36159
Created by unknown00759

References

https://www.sourcecodester.com/php/16525/lost-and-found-i...
http://lost.com
https://cyberredteam.tech/posts/cve-2023-36159/

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

.