Cross Site Scripting Vulnerability in Service Provider Management System by SourceCodester
CVE-2023-43456

5.4MEDIUM

Key Information:

Vendor

Oretnom23

Status
Service Provider Management System
Vendor
CVE Published:
25 September 2023

What is CVE-2023-43456?

A cross site scripting vulnerability exists in the Service Provider Management System v.1.0. This flaw could allow an attacker to inject malicious scripts through URL parameters such as firstname, middlename, and lastname within the /php-spms/admin/?page=user endpoint. If exploited, this vulnerability could enable unauthorized access to sensitive information, potentially compromising user data and system integrity.

References

https://www.sourcecodester.com/users/tips23
https://www.sourcecodester.com/php/16501/service-provider...
https://samh4cks.github.io/posts/cve-2023-43456/

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.