CVE-2023-53735
BaseFortify
Publication date: 2025-12-04
Last updated on: 2025-12-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webigniter | webigniter | 28.7.23 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a cross-site scripting (XSS) flaw in WEBIGniter version 28.7.23 that occurs during the user creation process. It allows unauthenticated attackers to inject and execute malicious JavaScript code, potentially leading to XSS attacks.
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute malicious scripts in the context of the affected application, which may lead to theft of user data, session hijacking, or other malicious actions performed on behalf of legitimate users.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing the user creation process for improper input sanitization, specifically by injecting typical XSS payloads such as `<img src onerror="prompt(8)">` into the 'your_name' parameter and observing if the script executes when visiting the users page. There are no specific commands provided, but manual testing or using web vulnerability scanners targeting the user creation page (e.g., https://webigniter.net/create-account) with XSS payloads can help detect the issue. [2]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include implementing strict input validation and encoding on the 'your_name' parameter in the user creation process to ensure all user inputs are sanitized and rendered safe, preventing the execution of malicious scripts. Additionally, restricting or escaping special characters in user inputs can help prevent XSS attacks. [2]