CVE-2023-4173

mooSocial mooStore index cross site scripting

CVSS 3.5 LOWEPSS 3.3%CWE-79

Vexday Risk Score

43Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 3.5EPSS 3.3%KEV nãoPoC públicaNuclei simMetasploit —Patch —

Lifecycle

06 Aug 2023Published on NVD

08 Aug 2023Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A vulnerability, which was classified as problematic, was found in mooSocial mooStore 3.1.6. Affected is an unknown function of the file /search/index. The manipulation of the argument q leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-236208.

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Affected products

mooSocial · mooStore

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/174016/mooSocial-3.1.8-Cross-Site-Scripting.htmlunverified exploitdbwww.exploit-db.com/exploits/51670unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/174016/mooSocial-3.1.8-Cross-Site-Scripting.html https://vuldb.com/?ctiid.236208 https://vuldb.com/?id.236208