Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1ycTdmLWo2OGYtbXFoM84AA8iV

PHP Server Monitor vulnerable to Cross-site Scripting

PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details.

Permalink: https://github.com/advisories/GHSA-rq7f-j68f-mqh3
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ycTdmLWo2OGYtbXFoM84AA8iV
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 4 months ago
Updated: 4 months ago

CVSS Score: 6.3
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

Identifiers: GHSA-rq7f-j68f-mqh3, CVE-2024-5312
References:

• https://nvd.nist.gov/vuln/detail/CVE-2024-5312
• https://github.com/PHPMailer/PHPMailer/commit/ff8718f72225a2e34d918c06a3b2c8cca5af3164
• https://www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor
• https://github.com/advisories/GHSA-rq7f-j68f-mqh3

Repository: https://github.com/PHPMailer/PHPMailer
Blast Radius: 1.0

Affected Packages