Lucene search

GoogleOSV:GHSA-RQ7F-J68F-MQH3

HistoryMay 24, 2024 - 6:45 p.m.

PHP Server Monitor vulnerable to Cross-site Scripting

2024-05-2418:45:28

Google

osv.dev

security

xss

php server monitor

vulnerability

cross-site scripting

session details

6.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

LOW

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L

5.7 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.0%

JSON

PHP Server Monitor, version 3.2.0, is vulnerable to an XSS via the /phpservermon-3.2.0/vendor/phpmailer/phpmailer/test_script/index.php page in all visible parameters. An attacker could create a specially crafted URL, send it to a victim and retrieve their session details.

CPENameOperatorVersion
phpservermon/phpservermoneq3.1.0
phpservermon/phpservermoneq3.2.1
phpservermon/phpservermoneq3.1.1
phpservermon/phpservermoneq3.2.2
phpservermon/phpservermoneq3.2.0-rc1
phpservermon/phpservermoneq3.2.0

Name	Operator	Version
phpservermon/phpservermon	eq	3.1.0
phpservermon/phpservermon	eq	3.2.1
phpservermon/phpservermon	eq	3.1.1
phpservermon/phpservermon	eq	3.2.2
phpservermon/phpservermon	eq	3.2.0-rc1
phpservermon/phpservermon	eq	3.2.0

References

github.com/PHPMailer/PHPMailer/commit/ff8718f72225a2e34d918c06a3b2c8cca5af3164

github.com/phpservermon/phpservermon

nvd.nist.gov/vuln/detail/CVE-2024-5312

www.incibe.es/en/incibe-cert/notices/aviso/cross-site-scripting-vulnerability-php-server-monitor