Vulnerability · Published Jan 28, 2023 · Assigned by VulDB
CVE-2023-0563PHPGurukul Bank Locker Management System Assign Locker add-locker-form.php cross site scripting
Low 3.5
In plain English
A low-severity cross-site scripting in Bank Locker Management System from PHPGurukul. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 37.6% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.
Official description
A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. This affects an unknown part of the file add-locker-form.php of the component Assign Locker. The manipulation of the argument ahname leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-219717 was assigned to this vulnerability.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| PHPGurukul | Bank Locker Management System | 1.0 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
References
- https://vuldb.com/?id.219717 vdb-entry, technical-description
- https://vuldb.com/?ctiid.219717 signature, permissions-required
- https://github.com/ctflearner/Vulnerability/blob/main/Bank_Locker_Management_System/BLMS_XSS_IN_ADMIN_BROWSER.md exploit