zzdevelop lenosp up to 20230831 Adduser Page Username cross site scripting ⚔ [Disputed]

Summaryinfo

A vulnerability, which was classified as problematic, has been found in zzdevelop lenosp up to 20230831. This issue affects some unknown processing of the component Adduser Page. Performing a manipulation of the argument Username with the input <script>alert(1)</script> results in cross site scripting. This vulnerability is reported as CVE-2023-7259. The attack is possible to be carried out remotely. Moreover, an exploit is present. The actual existence of this vulnerability is currently in question. The vendor rejected the issue because he claims that XSS which require administrative privileges are not of any use for attackers.

Detailsinfo

A vulnerability was found in zzdevelop lenosp up to 20230831. It has been classified as problematic. This affects an unknown functionality of the component Adduser Page. The manipulation of the argument username with the input value <script>alert(1)</script> leads to a cross site scripting vulnerability. CWE is classifying the issue as CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. This is going to have an impact on integrity.

The weakness was disclosed 08/31/2023 as I7XC2Y. It is possible to read the advisory at gitee.com. This vulnerability is uniquely identified as CVE-2023-7259. The exploitability is told to be easy. It is possible to initiate the attack remotely. Additional levels of successful authentication are required for exploitation. It demands that the victim is doing some kind of user interaction. Technical details and a public exploit are known. The attack technique deployed by this issue is T1059.007 according to MITRE ATT&CK.

The exploit is shared for download at gitee.com. It is declared as proof-of-concept. The real existence of this vulnerability is still doubted at the moment. The vendor rejected the issue because he claims that XSS which require administrative privileges are not of any use for attackers.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• zzdevelop

Name

• lenosp

Version

• 20230831

Website

• Product: https://gitee.com/zzdevelop/lenosp/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion