CVE-2023-6275

LOWNuclei

TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-6275 has a selected CVSS score of 3.5 (low); EIP currently links 2 repository PoCs and 1 Nuclei template.

Description

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.7.1-231128, 1.8.0-231127 and 1.8.1-231127 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-246104.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
2
Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 3, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Fluig Platform

Browse TOTVS / Fluig Platform
CVE List1.6.xaffected
1.7.xaffected
1.8.0affected
1.8.1affected

Proofs of concept

2

Repository PoCs

GitHubLelioCosta/FLUIG-Vulnerabilidade-CVE-2023-6275Repository PoCby LelioCosta0Writeup1 file

1.4 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Markdown writeup describing CVE-2023-6275, a reflected XSS vulnerability in TOTVS Fluig Platform. It details affected versions, attack vectors, and example payloads, but contains no executable exploit or scanner code.

Backdoor review

No backdoor observed in reviewed code

The artifact is a single README.md file that documents CVE-2023-6275, a reflected XSS vulnerability in TOTVS Fluig Platform. It contains no executable code, no concealed payload, and no instructions for the reviewer to perform any action. The content is purely informational disclosure of a known vulnerability.

ClassificationWriteup
Model confidence95%
AuthenticationUnknown
LanguagesMarkdown
Target softwareTOTVS Fluig Platform
Attack typesCross-Site Scripting (XSS)
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a single README.md file containing a textual description of CVE-2023-6275, including affected versions, attack vectors, and example payloads. It does not contain any executable code, scripts, or automated logic to exploit or scan for the vulnerability. The content is purely informational, fitting the definition of a writeup.

README.md:1-23

Requirements

  • Target must be running a vulnerable version of TOTVS Fluig Platform (1.6.x to 1.8.1).README.md:5-6
  • Victim must interact with a crafted link containing a malicious payload in the redirectUrl or user parameter.README.md:15-17

Observed behavior

  • The writeup documents the vulnerable endpoint /mobileredir/openApp.jsp and provides example XSS payloads for the redirectUrl and user parameters.README.md:15-20
  • The writeup references external sources (NVD, VulDB) for vulnerability details and states that a public exploit is known.README.md:2-3README.md:22-23
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Vulnerability Disclosure
Payload withheldThe README describes a known XSS vulnerability with example payloads and affected versions, consistent with public CVE records.README.md:1-23
Review boundaries

What the analysis did not establish

  • Evidence consists of a single Markdown file; no executable source code, scripts, or binaries are present.
  • The writeup mentions a public exploit but does not include it; the artifact itself is not an exploit or scanner.
  • Only the README.md file was provided; no other repository files were included for review. The analysis scope confirms no executable source code was identified in the artifact.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

GitHuberickfernandox/CVE-2023-6275Repository PoCby erickfernandox1Not analyzed1 file

865 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMTOTVS Fluig Platform - Cross-Site ScriptingCVSS 6.1

A vulnerability was found in TOTVS Fluig Platform 1.6.x/1.7.x/1.8.0/1.8.1. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /mobileredir/openApp.jsp of the component mobileredir. The manipulation of the argument redirectUrl/user with the input "><script>alert(document.domain)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used.

Impact

Unauthenticated attackers can inject malicious JavaScript via reflected XSS in the redirectUrl and user parameters, potentially stealing user session cookies or redirecting users to malicious sites.

Remediation

Update TOTVS Fluig Platform to a version newer than 1.8.1 that properly sanitizes user input.

WeaknessesCWE-79
Authorss4e-io
Template tagscvecve2023xssfluigvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:totvs:fluig:*:*:*:*:*:*:*:*
FOFA: app="TOTVS-Fluig"
https://github.com/erickfernandox/CVE-2023-6275 https://nvd.nist.gov/vuln/detail/CVE-2023-6275 https://vuldb.com/?id.246104

Source: ProjectDiscovery

References

4