CVE-2023-31302

Vulnerability

A reflected Cross-Site Scripting (XSS) vulnerability exists in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718, released 2021-07-06). The flaw resides in the Teller input field, which fails to properly neutralize user-supplied input before rendering it in the web page [1]. When a user interacts with the vulnerable field and clicks the Select button, the unsanitized input is executed in the browser [1].

Exploitation

An attacker can exploit this vulnerability by crafting a malicious payload in the Teller field. No authentication is explicitly required to access the feature, though the user must be logged into the application for the attack to execute. The attacker must lure a victim to a page containing the crafted Teller field, or if the user can submit the Teller value via a request (e.g., through a URL parameter), the XSS triggers when the user pushes the Select button [1]. The attack is reflected — payload is not persisted on the server.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to cookie theft, session hijacking, defacement, or redirection to malicious sites. The CVSS base score is not disclosed in the reference, but the advisory classifies the risk as Medium [1].

Mitigation

The vendor has acknowledged the vulnerability and released a fix. Users should update CPTO to the current version, as the advisory notes that the vendor status is Fixed [1]. As a workaround, input sanitization on the Teller field should be enforced. No CVE link was available at the time of the advisory publication [1].