zzdevelop lenosp up to 20230831 Adduser Page Username cross site scripting ⚔ [Disputed]

A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown functionality of the component Adduser Page. The manipulation of the argument username with the input value <script>alert(1)</script> leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.

The weakness was disclosed 08/31/2023 as I7XC2Y. It is possible to read the advisory at gitee.com. This vulnerability is uniquely identified as CVE-2023-7259. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The exploit is shared for download at gitee.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor rejected the issue because he claims that XSS which require administrative privileges are not of any use for attackers.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Productinfo

Vendor

• zzdevelop

Name

• lenosp

Version

• 20230831

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion