CVE-2023-5286: XSS in Expense Tracker App v1

Successful exploitation of CVE-2023-5286 allows an attacker to inject arbitrary JavaScript code into the Expense Tracker App. This code can then be executed in the context of a victim's browser when they access a crafted URL. The impact ranges from simple defacement of the application's interface to more severe consequences like stealing session cookies, redirecting users to malicious websites, or even gaining unauthorized access to sensitive data stored within the application. The remote nature of the vulnerability means an attacker doesn't need local access to the server to exploit it.

1. Reserved2023-09-29
2. Published2023-09-29
3. Modified2024-09-23
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5286 is to upgrade to version 1.0.1 of the Expense Tracker App. This version includes a fix for the vulnerable addcategory.php file. If upgrading immediately is not possible, consider implementing input validation and sanitization on the categoryname parameter to prevent the injection of malicious scripts. While a Web Application Firewall (WAF) might offer some protection, it's not a substitute for patching the application. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert('XSS')</script>) into the category name field and confirming that it is properly sanitized or blocked.