hu60t hu60wap6 ubbparser.php markdown cross site scripting

Successful exploitation of CVE-2023-5835 allows an attacker to inject arbitrary JavaScript code into the application's output. This code can then be executed in the context of a victim's browser when they visit a vulnerable page. The impact ranges from simple defacement to more severe consequences such as stealing session cookies, redirecting users to malicious websites, or even gaining control of the user's account. The lack of versioning makes it difficult to assess the full scope of affected deployments, but any instance using the vulnerable ubbparser.php file is at risk. The attack vector is remote, meaning an attacker does not require local access to exploit the vulnerability.

Any deployment utilizing the vulnerable ubbparser.php component within the hu60wap6 software is at risk. This includes systems where the component has been directly integrated or used as a dependency. The absence of versioning means that identifying specific vulnerable deployments is challenging, requiring careful examination of installed files.

1. 2023-10-28Disclosure

   disclosure

1. Réservé2023-10-27
2. Publiée2023-10-28
3. Modifiée2024-08-02
4. EPSS mis à jour2026-04-02

The primary mitigation for CVE-2023-5835 is to apply the provided patch: a1cd9f12d7687243bfcb7ce295665acb83b9174e. Since the software lacks versioning, applying this patch is the only known remediation. There are no immediate rollback steps available if the patch introduces unexpected issues, so thorough testing in a staging environment is highly recommended before deploying to production. Web application firewalls (WAFs) configured to detect and block XSS payloads might offer some protection, but relying solely on a WAF is not a substitute for patching. Input validation and output encoding should be implemented as a general security best practice to prevent future XSS vulnerabilities.