CVE-2023-36346

Vulnerability

POS Codekop v2.0 (commit ebc5c29) is affected by a reflected cross-site scripting (XSS) vulnerability in the print.php script. The nm_member parameter is not sanitized or validated before being reflected in the response, allowing an attacker to inject arbitrary HTML or JavaScript. The vulnerability is present in the v2.0 release.

Exploitation

An attacker can craft a malicious URL containing JavaScript code in the nm_member parameter and trick a victim into clicking it via phishing or social engineering. No authentication or special privileges are required to trigger the vulnerability, as print.php is accessible to unauthenticated users.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, credential theft, defacement, or other client-side attacks. The scope is limited to the affected application and browser session.

Mitigation

As of the publication date (2023-06-23), no patch has been disclosed for this vulnerability. Users should monitor the vendor's repository for updates, sanitize user input in print.php, or implement a Web Application Firewall (WAF) to filter malicious payloads. The reference [1] confirms the vulnerability but does not provide a fix.