CVE-2023-41597

Deeper analysis

EyouCms version 1.6.2 contains a reflected cross-site scripting vulnerability in the administrative component located at /admin/twitter.php?active_t. The flaw is tracked as CVE-2023-41597 and is classified under CWE-79 with a CVSS 3.1 base score of 6.1 reflecting network attack vector, low complexity, no required privileges, required user interaction, and changed scope that permits limited impacts to confidentiality and integrity.

An unauthenticated remote attacker can exploit the issue by supplying a malicious payload in the active_t parameter of a crafted URL. When an authenticated administrator visits the link, the injected script executes in the context of the EyouCms administrative interface, enabling actions such as session token theft or unauthorized configuration changes within the affected application.

The associated EPSS score has remained flat at 0.1149 with no material increase since disclosure, indicating limited observed exploitation interest to date. No public advisories or patches are detailed in the supplied references.