Platform
php
Fixed in
1.0.1
A problematic cross-site scripting (XSS) vulnerability has been identified in SourceCodester Best Courier Management System versions 1.0 through 1.0. This flaw resides within the Manage Account Page component, allowing attackers to inject malicious scripts through manipulation of the 'First Name' parameter. The vulnerability is remotely exploitable and has been publicly disclosed. A patch is available in version 1.0.1.
Successful exploitation of CVE-2023-5302 allows an attacker to execute arbitrary JavaScript code within the context of a user's browser session. This can lead to various malicious outcomes, including session hijacking, phishing attacks, and defacement of the application. An attacker could steal sensitive user data, such as login credentials or personal information, or redirect users to malicious websites. The blast radius is limited to users interacting with the Manage Account Page, but the potential for widespread impact exists if the application has a large user base.
This vulnerability has been publicly disclosed and assigned the identifier VDB-240941. While no active exploitation campaigns have been definitively linked to CVE-2023-5302 at the time of writing, the public availability of the vulnerability increases the risk of exploitation. It is not currently listed on CISA KEV. The LOW CVSS score reflects the limited scope and relatively simple exploitation process.
Exploit Status
EPSS
0.07% (22% percentile)
CVSS Vector
The primary mitigation for CVE-2023-5302 is to immediately upgrade to version 1.0.1 of Best Courier Management System. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'First Name' field to sanitize user-supplied data. While not a complete solution, this can reduce the risk of successful exploitation. Reviewing and hardening the application's security configuration, including implementing a Web Application Firewall (WAF) with XSS protection rules, can also provide an additional layer of defense. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload into the 'First Name' field and verifying that the script is not executed.
Update Best Courier Management System to a version later than 1.0 or apply the patch provided by the vendor to correct the XSS vulnerability on the Manage Account Page. Validate and escape user input in the 'First Name' field to prevent the injection of malicious scripts. See the provided references for more details about the vulnerability and possible solutions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-5302 is a cross-site scripting (XSS) vulnerability affecting Best Courier Management System versions 1.0–1.0. It allows attackers to inject malicious scripts via the Manage Account Page's 'First Name' field.
You are affected if you are using Best Courier Management System version 1.0–1.0. Upgrade to version 1.0.1 to mitigate the risk.
The recommended fix is to upgrade to version 1.0.1. As a temporary workaround, implement input validation and output encoding on the 'First Name' field.
While no active exploitation campaigns have been definitively linked, the public disclosure increases the risk of exploitation.
Refer to the SourceCodester website or relevant security forums for the official advisory regarding CVE-2023-5302.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.