CodeAstro Internet Banking System pages_deposit_money.php cross site scripting

An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code through the accountnumber parameter in the pagesdeposit_money.php file. Successful exploitation allows the attacker to execute arbitrary code within the context of the user's browser session. This could lead to the theft of sensitive information like login credentials, session cookies, and financial data. The attacker could also redirect users to phishing sites or deface the website. Given the nature of internet banking systems, the potential impact is significant, potentially leading to financial loss and reputational damage for the affected organization.

Organizations using CodeAstro Internet Banking System version 1.0 are at risk. This includes financial institutions, credit unions, and any business providing online banking services through this system. Shared hosting environments where multiple customers share the same server are particularly vulnerable, as a compromise of one customer could potentially impact others.

• web:

curl -I 'https://example.com/pages_deposit_money.php?account_number=421873905--><ScRiPt%20>alert(9523)</ScRiPt><!--' | grep -i 'alert(9523)'

• generic web: Inspect the HTML source code of pagesdepositmoney.php for any unexpected JavaScript code or script tags. • generic web: Review access and error logs for suspicious requests containing potentially malicious input in the account_number parameter.

1. 2023-10-22Disclosure

   disclosure

2. 2023-10-22Patch

   patch

1. Reservado2023-10-22
2. Publicada2023-10-22
3. Modificada2024-08-02
4. EPSS atualizado2026-04-02

The primary mitigation for CVE-2023-5698 is to upgrade to version 1.0.1 of CodeAstro Internet Banking System. If upgrading immediately is not possible, implement input validation and sanitization on the accountnumber parameter to prevent the injection of malicious code. This should include strict whitelisting of allowed characters and escaping any potentially dangerous characters. Consider implementing a Web Application Firewall (WAF) with rules to detect and block XSS attempts targeting the pagesdeposit_money.php file. Regularly scan the application for XSS vulnerabilities using automated tools.