CVE-2023-30210

Deeper analysis

OURPHP versions up to and including 7.2.0 contain a reflected cross-site scripting vulnerability in ourphp_tz.php, tracked as CVE-2023-30210 and assigned CWE-79. The flaw carries a CVSS 3.1 score of 6.1 with network attack vector, low complexity, no required privileges, and required user interaction, resulting in changed scope with limited impacts to confidentiality and integrity.

An unauthenticated remote attacker can craft a malicious URL that, when visited by a victim, executes arbitrary script in the context of the OURPHP application. Because the scope is changed, the injected script can affect resources beyond the immediate vulnerable page, enabling actions such as session hijacking or unauthorized actions on behalf of the user.

The EPSS score has remained flat at 0.1520 with no material increase since disclosure. The two available references consist of a single technical write-up detailing the reflection vector but contain no information on official patches or mitigation steps.