T
TraceWithin
leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221799.","vulnerabilityLevel":"MEDIUM","cvssScore":6.1,"affectedProduct":{"@type":"Product","name":"simple responsive tourism website","manufacturer":{"@type":"Organization","name":"oretnom23"}}},"keywords":"CVE-2023-1041, medium, security vulnerability, CVE, oretnom23, simple responsive tourism website, exploit available, cybersecurity, threat intelligence","aggregateRating":{"@type":"AggregateRating","ratingValue":6.1,"bestRating":10,"worstRating":0,"ratingCount":1}}

CVE-2023-1041

Medium
|6.1
Exploit Available

Plain English Summary

AI-powered analysis for quick understanding

This vulnerability allows an attacker to inject malicious scripts into the website, which could lead to unauthorized actions or data theft from users who visit the affected page. It can be exploited remotely by manipulating a specific input field without needing any special access or credentials.

Technical Description

A vulnerability, which was classified as problematic, was found in SourceCodester Simple Responsive Tourism Website 1.0. This affects an unknown part of the file /tourism/rate_review.php. The manipulation of the argument id with the input 1"><script>alert(1111)</script> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-221799.

CVSS Vector Analysis

Attack VectorNetwork
Attack ComplexityLow
Privileges RequiredNone
User InteractionRequired
Confidentiality ImpactLow
Integrity ImpactLow
Availability ImpactNone
ScopeChanged

Vector String

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploit Resources

Search for proof-of-concept code and exploit modules

GitHub SearchExploit-DBNuclei TemplatesMetasploitVulners

Official References

NIST NVD
Est. Bounty
$862($500-$1K)
Vendor Response
Grade FPatched in 1088 days

Quick Information

Published

Feb 26, 2023

almost 3 years ago

Last Modified

Feb 18, 2026

2 days ago

Vendor

oretnom23

Product

simple responsive tourism website

Related Vulnerabilities

CVE-2022-31354Critical

This vulnerability allows an attacker to manipulate the online car wash booking system's database, potentially gaining access to sensitive information or altering data. To exploit this, the attacker needs to send specially crafted requests to a specific URL in the system.

CVE-2022-31353Critical

This vulnerability allows an attacker to manipulate the database of the online car wash booking system, potentially gaining access to sensitive information or altering data. It can be exploited by sending specially crafted requests to a specific URL, making it critical for anyone using this system to secure it immediately.

CVE-2022-31352Critical

This vulnerability allows an attacker to manipulate the database of the online car wash booking system, potentially gaining access to sensitive information or altering data. It requires the attacker to send a specially crafted request to the manage_service.php page with a specific ID parameter.

CVE-2022-31351Critical

This vulnerability allows an attacker to manipulate the online car wash booking system's database by injecting harmful SQL code through a specific URL, potentially gaining access to sensitive information or altering data. To exploit this, the attacker needs to access the admin services page with the right parameters, making it critical for system security.

CVE-2022-31350Critical

This vulnerability allows an attacker to manipulate the database of the online car wash booking system, potentially gaining access to sensitive information or altering data. It can be exploited by sending specially crafted requests to a specific URL, making it critical for anyone using this system to secure it immediately.