Platform
php
Component
engineers-online-portal
Fixed in
1.0.1
CVE-2023-7160 is a cross-site scripting (XSS) vulnerability discovered in SourceCodester Engineers Online Portal versions 1.0. This flaw allows an attacker to inject malicious scripts into the application, potentially leading to session hijacking or defacement. The vulnerability impacts the Add Engineer Handler functionality and affects versions 1.0. A patch is available in version 1.0.1.
An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code into the first name or last name fields of the Add Engineer Handler. When a user views the page containing the injected script, the script will execute in their browser context. This can allow the attacker to steal session cookies, redirect the user to a malicious website, or modify the content of the page. The potential impact extends to any user who interacts with the vulnerable functionality, making it a significant risk, especially in environments where sensitive data is handled.
This vulnerability has been publicly disclosed and a proof-of-concept may be available. The exploit is relatively straightforward, making it likely that attackers will attempt to exploit it. The vulnerability was published on 2023-12-29. It is not currently listed on CISA KEV.
Exploit Status
EPSS
0.10% (26% percentile)
CVSS Vector
The primary mitigation for CVE-2023-7160 is to upgrade to version 1.0.1 of Engineers Online Portal. If upgrading is not immediately feasible, consider implementing input validation and sanitization on the Add Engineer Handler to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Regularly review and update security policies to address potential XSS vulnerabilities.
Update to a patched version of the software. Validate and sanitize the inputs of the 'first name' and 'last name' fields to prevent the injection of malicious code. Implement a content security policy (CSP) to mitigate XSS attacks.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-7160 is a cross-site scripting (XSS) vulnerability affecting Engineers Online Portal version 1.0, allowing attackers to inject malicious scripts via the Add Engineer Handler.
If you are using Engineers Online Portal version 1.0, you are potentially affected. Upgrade to version 1.0.1 to mitigate the risk.
Upgrade to version 1.0.1. As a temporary workaround, implement input validation and sanitization on the Add Engineer Handler.
While active exploitation is not confirmed, the vulnerability has been publicly disclosed and a proof-of-concept may be available, increasing the likelihood of exploitation.
Refer to the SourceCodester website or relevant security advisories for the official advisory regarding CVE-2023-7160.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.