CVE-2023-45958
Description
Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter at /controller/AdminController.php. This vulnerability allows attackers to execute arbitrary JavaScript in the web browser of a user via a crafted payload.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Thirty Bees/Coredescription
- Range: = 1.4.0
Patches
Vulnerability mechanics
Root cause
"The backup_pagination parameter is not properly sanitized before being used in the admin interface, allowing for reflected cross-site scripting."
Attack vector
An attacker can craft a malicious URL containing a JavaScript payload within the backup_pagination parameter. When a user, typically an administrator, accesses this crafted URL in the web browser, the JavaScript payload is executed. This occurs because the application reflects the unsanitized parameter value within the HTML output of the page, specifically in the context of list pagination. [ref_id=1]
Affected code
The vulnerability exists in the `displayListHeader` method within the `AdminController.php` file. Specifically, the code handling the `backup_pagination` parameter was not adequately sanitizing user input before rendering it on the page. The patch modifies this section by introducing new helper methods to properly resolve and validate pagination values. [ref_id=1]
What the fix does
The patch introduces a new method, `resolvePagination`, which sanitizes the `backup_pagination` parameter. This method ensures that the pagination value is an integer and checks if it is a valid positive number before it is used. This prevents the injection of arbitrary JavaScript code by validating and sanitizing the input, thus mitigating the reflected XSS vulnerability. [ref_id=1]
Preconditions
- authThe target user must be logged into the Thirty Bees administration panel.
- inputThe attacker must be able to trick a victim into clicking a specially crafted URL.
Generated on Jun 4, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.