CVE-2023-29623

Deeper analysis

Purchase Order Management v1.0 contains a reflected cross-site scripting vulnerability (CWE-79) that is triggered when the password parameter is processed by the script at /purchase_order/classes/login.php. The flaw received a CVSS 3.1 score of 6.1, reflecting network attack vector, low complexity, no required privileges, and required user interaction that results in changed scope with limited impact on confidentiality and integrity.

An unauthenticated attacker can supply a crafted URL containing malicious JavaScript in the password field; when a victim follows the link, the script executes inside the application’s origin. Successful exploitation allows the attacker to read limited data from the victim’s session or perform actions on the victim’s behalf within the affected purchase-order application.

Public references consist of proof-of-concept code demonstrating the reflected XSS payload together with general guidance on reflected cross-site scripting; no vendor advisory or patch information is provided in the available sources. The associated EPSS score has remained near 0.26 with a recorded peak of 0.27, indicating moderate and relatively stable exploitation probability.