CVE-2023-7135: XSS in Record Management System 1.0

The primary impact of CVE-2023-7135 is the potential for cross-site scripting (XSS) attacks. An attacker can inject arbitrary JavaScript code into the Record Management System by manipulating the 'officename' parameter in the 'offices.php' file. This malicious script can then execute in the context of a user's browser, allowing the attacker to steal cookies, redirect users to phishing sites, or deface the application. The vulnerability is remotely exploitable, meaning an attacker does not need to be authenticated to exploit it. Given the public disclosure of this vulnerability, it is highly likely that attackers are actively scanning for and exploiting vulnerable instances.

1. Reserved2023-12-28
2. Published2023-12-28
3. Modified2024-08-02
4. EPSS updated2026-04-02

The recommended mitigation for CVE-2023-7135 is to immediately upgrade to version 1.0.1 of the Record Management System. This version contains a fix for the XSS vulnerability. If upgrading is not immediately possible, consider implementing input validation and output encoding on the 'officename' parameter in 'offices.php' to sanitize user input. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the 'officename' parameter and verifying that the script does not execute.