CVE-2023-3845

Deeper analysis

A vulnerability rated problematic exists in mooSocial mooDating version 1.2 within the URL Handler component, specifically the file /friends/ajax_invite. The issue stems from improper handling of input that permits cross-site scripting (CWE-79). The affected software is a social dating platform, and the flaw was disclosed after unsuccessful attempts to contact the vendor.

An attacker with low-privileged authenticated access can exploit the flaw remotely by supplying crafted input to the affected endpoint. Successful exploitation results in script execution in a victim user's browser, enabling limited integrity impacts such as unauthorized actions performed in the context of the targeted session; user interaction is required and there is no impact on confidentiality or availability.

Public references on VulDB and Packet Storm document the XSS vector via proof-of-concept submissions but contain no vendor patch or mitigation guidance, consistent with the non-functional disclosure contact address. The associated EPSS score reached a peak of 0.0981 after publication, indicating emerging exploitation interest that warrants renewed attention despite the modest CVSS base score of 3.5.