CVE-2023-31301

An unauthenticated attacker inserts a JavaScript payload into the Username field of the login form [ref_id=1]. The payload is stored server-side and later rendered unsanitized when an admin user views the application log, which displays authentication attempts, invalid and blacklisted user IDs [ref_id=1]. When the admin's browser executes the injected script, the attacker can execute arbitrary code and obtain sensitive information in the context of the admin session [CWE-79]. No authentication is required to submit the malicious payload, making the attack vector accessible to any remote attacker.

The vulnerability resides in the login form's Username field and the application log of Sesami CPTO version 6.3.8.6 (#718). The advisory does not specify exact file paths or function names, but the Username input field on the login page and the log-viewing page where authentication attempts are displayed are the affected code paths [ref_id=1].

The vendor fixed the vulnerability in a subsequent version of CPTO, though no patch diff is publicly available [ref_id=1]. The advisory recommends that user-supplied input should always be sanitized before being stored or rendered, which would prevent JavaScript payloads in the Username field from executing in the admin's browser when viewing the application log [ref_id=1]. Users should update CPTO to its current version to receive the fix.