CVE-2023-3757 - GZ Scripts Car Rental Script cross site scripting

Back Back to CVE browser

MEDIUM

GZ Scripts Car Rental Script cross site scripting

Published Jul 19, 2023

6.1

MEDIUM

CVSS 3.1

EPSS 0.36%

Description

A vulnerability classified as problematic has been found in GZ Scripts Car Rental Script 1.8. Affected is an unknown function of the file /EventBookingCalendar/load.php?controller=GzFront/action=checkout/cid=1/layout=calendar/show_header=T/local=3. The manipulation of the argument first_name/second_name/phone/address_1/country leads to cross site scripting. It is possible to launch the attack remotely. The identifier of this vulnerability is VDB-234432. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

Vendor GZ Scripts Product Car Rental Script Default
n/a
- Version
  1.8
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

GZ Scripts

Car Rental Script

n/a

Version	Status	Constraints
1.8	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-79

Cross-site Scripting (XSS)

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44392
Advisory
https://vuldb.com/?ctiid.234432
signaturePermissions RequiredThird Party Advisory
https://vuldb.com/?id.234432
vdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-44392		Advisory
https://vuldb.com/?ctiid.234432		signaturePermissions RequiredThird Party Advisory
https://vuldb.com/?id.234432		vdb-entrytechnical-descriptionThird Party Advisory