CVE-2023-5694: XSS in CodeAstro Internet Banking System

The XSS vulnerability in CodeAstro Internet Banking System allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be exploited to steal session cookies, redirect users to malicious websites, or deface the banking system's interface. Successful exploitation could lead to unauthorized access to user accounts, financial fraud, and reputational damage for the banking institution. The remote nature of the vulnerability means attackers don't need local access to exploit it.

1. Reserved2023-10-22
2. Published2023-10-22
3. Modified2024-08-02
4. EPSS updated2026-04-02

The primary mitigation for CVE-2023-5694 is to upgrade to CodeAstro Internet Banking System version 1.0.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the sysname parameter within pagessystemsettings.php. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the sysname parameter and verifying that the script does not execute.