CVE-2023-30210

MEDIUMNuclei

OURPHP <= 7.2.0 - Cross Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2023-30210 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.

Description

OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Feb 3, 2025 · Source: CVE List

Nuclei templates

1
ProjectDiscoveryMEDIUMOURPHP <= 7.2.0 - Cross Site ScriptingCVSS 6.1

OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via /client/manage/ourphp_tz.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement.

Remediation

Upgrade to a patched version of OURPHP (7.2.1 or higher) to mitigate this vulnerability.

WeaknessesCWE-79
Authorstheamanrawat
Template tagscve2023cvexssourphpunauthenticatedvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:ourphp:ourphp:*:*:*:*:*:*:*:*
https://www.ourphp.net/ https://wanheiqiyihu.top/2023/03/27/OURPHP-v7-2-0-ourphp-tz-php-Reflection-xss/ https://nvd.nist.gov/vuln/detail/CVE-2023-30210

Source: ProjectDiscovery

References

2