Medium severity · published May 14, 2024
CVE-2023-24203
Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the company or query…
5.4
CVSS
0.6%
EPSS
No
On KEV
Description
Cross Site Scripting vulnerability in SourceCodester Simple Customer Relationship Management System v1.0 allows attacker to execute arbitary code via the company or query parameter(s).
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SC
Simple Customer Relationship Management System · Oretnom23
1.0 · source: NVD
Affected product
SC
Simple Customer Relationship Management System
Oretnom23
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-24203
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-24203
Exploit
https://github.com/momo1239/CVE-2023-24203-and-CVE-2023-24204
URL Repurposed
https://momonguyen.com/2023/cve-2023-24203/
Product
https://www.sourcecodester.com
More from Simple Customer Relationship Management System
9.8
CVE-2023-24655
Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the Profile Update function
9.8
CVE-2023-0917
A vulnerability, which was classified as critical, was found in SourceCodester Simple Customer Relationship Management System 1.0
8.8
CVE-2023-24732
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the user profile update function
8.8
CVE-2023-24731
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the user profile update function
8.8
CVE-2023-24730
Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the user profile update function