CVE-2023-1367 – Easyappointments
Stored Html Injection
easyappointments present an html injection vulnerability on the company name field on “/index.php/backend/settings” page.
POC – Proof of concept
- login as admin
- go to /index.php/backend/settings Page
- insert the payload in Company Name field
- go back to the home page and see the result.
PAYLOAD: ------><a href="https://google.com"> CLICKHERE</a> <------Impact
*. A stored HTML injection attack occurs when an attacker injects malicious HTML code into legitimate HTML code of a web application.
*. This vulnerability can lead to various types of attacks, including open redirects, phishing attempts, and browser hijacking.
*. Additionally, an attacker can gain access to the victim’s IP address, latitude and longitude, and potentially carry out a camera phishing attack.
*. Overall, a stored HTML injection vulnerability can have severe consequences and it is important to prevent and mitigate this type of attack.
References
Severity
https://cvss.js.org/#CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L
Reference
https://nvd.nist.gov/vuln/detail/CVE-2023-1367
https://huntr.dev/bounties/16bc74e2-1825-451f-bff7-bfdc1ea75cc2/
https://github.com/alextselegidis/easyappointments