CodeAstro Internet Banking System pages_system_settings.php cross site scripting

The XSS vulnerability in CodeAstro Internet Banking System allows an attacker to execute arbitrary JavaScript code within the context of a user's browser. This can be exploited to steal session cookies, redirect users to malicious websites, or deface the banking system's interface. Successful exploitation could lead to unauthorized access to user accounts, financial fraud, and reputational damage for the banking institution. The remote nature of the vulnerability means attackers don't need local access to exploit it.

Financial institutions using CodeAstro Internet Banking System version 1.0 are directly at risk. Shared hosting environments where multiple banking systems are deployed on the same server could also be affected, as a vulnerability in one system could potentially compromise others. Organizations relying on legacy configurations or custom modifications of the CodeAstro system may be particularly vulnerable.

• generic web: Use curl or wget to test the pagessystemsettings.php endpoint with a simple XSS payload (e.g., <script>alert(1)</script>) in the sys_name parameter. Check the response for the presence of the alert box.

curl 'http://your-internet-banking-system/pages_system_settings.php?sys_name=<script>alert(1)</script>' 

• php: Examine the pagessystemsettings.php file for inadequate input validation or output encoding of the sysname parameter. Search for patterns like echo $GET['sys_name'] without proper sanitization.

1. 2023-10-22Disclosure

   disclosure

2. 2023-10-22Patch

   patch

1. आरक्षित2023-10-22
2. प्रकाशित2023-10-22
3. संशोधित2024-08-02
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2023-5694 is to upgrade to CodeAstro Internet Banking System version 1.0.1 or later, which includes the necessary fix. If upgrading immediately is not feasible, consider implementing input validation and output encoding on the sysname parameter within pagessystemsettings.php. Web application firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the sysname parameter and verifying that the script does not execute.