CodeAstro Internet Banking System pages_withdraw_money.php cross site scripting

The vulnerability lies within the pageswithdrawmoney.php file, specifically in how it handles the accountnumber parameter. An attacker can craft a malicious URL containing a specially crafted accountnumber value (e.g., 287359614--><ScRiPt>alert(1234)</ScRiPt><!--) that, when processed by the application, will execute arbitrary JavaScript code in the user's browser. This could lead to session hijacking, redirection to phishing sites, or the theft of sensitive information like login credentials and financial details. The impact is particularly severe given the context of an internet banking system, where users entrust sensitive financial data.

Users of CodeAstro Internet Banking System versions 1.0 through 1.0 are at risk. This includes individuals and businesses relying on this system for online banking transactions. Shared hosting environments where multiple websites share the same server resources are particularly vulnerable, as a compromise of one website could potentially affect others.

• php: Examine the pageswithdrawmoney.php file for unsanitized use of the account_number parameter. Search for instances where user input is directly outputted to the HTML without proper encoding.

// Example of vulnerable code
<?php
echo $_GET['account_number']; // Vulnerable to XSS
?>

• generic web: Monitor access logs for requests containing suspicious characters in the account_number parameter, such as <script> tags or event handlers.

 grep '<script' /var/log/apache2/access.log

• generic web: Check response headers for the presence of X-XSS-Protection or Content-Security-Policy headers, which can help mitigate XSS attacks.

1. 2023-10-22Disclosure

   disclosure

1. Reservado2023-10-22
2. Publicada2023-10-22
3. Modificada2024-08-02
4. EPSS atualizado2026-04-02

The primary mitigation is to upgrade to version 1.0.1 of CodeAstro Internet Banking System, which contains the fix for this vulnerability. If upgrading immediately is not possible, consider implementing input validation and sanitization on the accountnumber parameter to prevent the injection of malicious scripts. Web application firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor application logs for suspicious activity, particularly requests containing unusual characters or patterns in the accountnumber parameter.