CVE-2023-39712

Vulnerability

The Free and Open Source Inventory Management System v1.0 [1] is vulnerable to multiple stored cross-site scripting (XSS) attacks. The vulnerability exists in the "Add New Put" section under the supplier page, where the Name, Address, and Company input fields are not properly sanitized. An attacker can inject arbitrary web scripts or HTML via these parameters, which are then stored and executed when the page is viewed.

Exploitation

An attacker must first register and log in to the application. Then, navigate to the supplier section at index.php?page=suppliar and click "Add New". In the Name, Address, and Company fields, the attacker inputs a payload such as ">. Upon submission, the payload is stored and executed in the context of any user viewing the supplier records [2].

Impact

Successful exploitation allows an attacker to execute arbitrary HTML and JavaScript in the browser of any user who accesses the affected supplier page. This can lead to session hijacking, credential theft, defacement, or redirection to malicious sites. The attack requires no special privileges beyond a registered user account.

Mitigation

As of the publication date, no official patch or updated version has been released to address these XSS vulnerabilities. The vendor has not provided a fixed version or workaround [1][2]. Users should consider applying input validation and output encoding manually or disabling the affected functionality until a fix is available.