CVE-2023-30212

published 2023-04-26

CVE-2023-30212: OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.

Priority P3 42 medium 6.1 CVSS 3.1

AV N AC L PR N UI R S C C L I L A N

EXPLOIT

OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
ourphp	ourphp	<= 7.2.0	—

Detection & IOCs extracted from sources · hover to see the quote

path /client/manage/ourphp_out.php↗

sigma

matchers-condition: and
matchers:
- type: word
  part: body
  words:
  - "location.href='../..alert(document.domain)'"
- type: word
  part: header
  words:
  - "text/html"
- type: status
  status:
  - 200

• → Detect XSS exploitation attempts against OURPHP by looking for the reflected payload string 'location.href=\'../..alert(document.domain)\'' in HTTP response bodies to requests targeting /client/manage/ourphp_out.php.
• → Alert on HTTP 200 responses with Content-Type text/html containing the XSS payload string, indicating successful reflection of the injected script.

• · Vulnerability affects OURPHP versions 7.2.0 and below; ensure detection rules are scoped to environments running these versions. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-79