Reflected XSS in Ourphp via ourphp_out.php

Ourphp versions 7.2.0 and earlier contain a reflected cross-site scripting (XSS) vulnerability, identified as CVE-2023-30212. The vulnerability resides in the '/client/manage/ourphp_out.php' file, where the 'out' parameter is insufficiently sanitized when the 'ourphp_admin' parameter is set to 'logout'. An attacker can craft a malicious URL containing arbitrary JavaScript payloads, which will then be executed within the context of a victim's browser if they navigate to the link. This flaw, classified with a CVSS 6.1 score, poses a risk of session hijacking, credential theft, and unauthorized actions performed on behalf of the victim. Public proof-of-concept (PoC) code has been released, increasing the risk of exploitation for organizations still running affected versions of the software.

Attack Chain

1. Attacker identifies a target running Ourphp version 7.2.0 or earlier.
2. Attacker crafts a malicious URL pointing to the vulnerable endpoint: '/client/manage/ourphp_out.php?ourphp_admin=logout&out=[PAYLOAD]'.
3. Attacker injects a JavaScript payload into the 'out' parameter (e.g., '<script>alert(1)</script>').
4. Attacker uses social engineering or phishing to trick an authenticated or targeted user into clicking the malicious link.
5. The victim's browser requests the endpoint with the injected script.
6. The Ourphp application reflects the unsanitized payload back to the victim's browser.
7. The browser executes the injected script in the context of the user's active session, enabling token theft or forced actions.

Impact

Successful exploitation of CVE-2023-30212 enables an attacker to execute arbitrary scripts in the victim's browser session. This can lead to the compromise of user sessions, theft of sensitive information (such as session cookies or CSRF tokens), and the potential to perform unauthorized administrative actions if the victim is an authorized user. The vulnerability is network-accessible and requires user interaction, making it a viable target for credential-harvesting or session-hijacking campaigns.

Recommendation

• Prioritize upgrading all instances of Ourphp to a version beyond 7.2.0, as there is currently no evidence of an official patch release for this specific legacy version mentioned in the source material.
• Deploy the Sigma rule below to monitor for exploitation attempts targeting the identified endpoint in web server logs.
• Implement Content Security Policy (CSP) headers to mitigate the impact of reflected XSS by restricting where scripts can be loaded and executed.
• Educate users on the risks of clicking suspicious links, especially those directing to internal administrative portals.