CVE-2023-24733

Deeper analysis

PMB version 7.4.6 contains a reflected cross-site scripting vulnerability in the query parameter handled by the script /admin/convert/export_z3950_new.php. The flaw is tracked as CVE-2023-24733 and is classified under CWE-79, with a CVSS 3.1 base score of 6.1 reflecting network attack vector, low complexity, no required privileges, and required user interaction that results in changed scope with limited confidentiality and integrity impact.

An unauthenticated attacker can craft a malicious URL containing executable script in the query parameter and deliver it to a victim user. When the victim follows the link, the script executes in the context of the PMB administrative interface, enabling actions such as session token theft or unauthorized actions within the affected application.

Public references consist of proof-of-concept material hosted on GitHub, while the EPSS score has remained essentially flat near 0.15 with a recorded peak of 0.1509, indicating moderate but stable exploitation interest since disclosure. No vendor advisory or patch information is referenced in the available sources.