CVE-2023-31298

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718). The vulnerability, classified as CWE-79, allows an admin user to inject JavaScript code into the User ID field when creating a new system user. The injected script executes when the new user logs in for the first time and is prompted to change their password. The payload also triggers upon subsequent logins and when another admin user views the application log. [1]

Exploitation

An attacker with administrative privileges can create a new system user with a malicious JavaScript payload in the User ID field. The payload executes automatically when the new user logs in, without requiring additional user interaction beyond normal login steps. The script also runs when other admin users view the application log, broadening the attack surface. [1]

Impact

Successful exploitation allows arbitrary JavaScript execution in the context of the application, potentially leading to information disclosure, session hijacking, or unauthorized actions. The attacker can execute arbitrary code and obtain sensitive information. The risk is rated as medium. [1]

Mitigation

Users should update CPTO to the current version. The vendor has acknowledged the vulnerability and provided a fix. Input sanitization is recommended to prevent similar issues. No specific patched version number is listed in the advisory, but the vendor status is marked as "Fixed". [1]