Attack Chain

1. Attacker identifies a target running Ourphp version 7.2.0 or earlier.
2. Attacker crafts a malicious URL pointing to the vulnerable endpoint: '/client/manage/ourphp_out.php?ourphp_admin=logout&out=[PAYLOAD]'.
3. Attacker injects a JavaScript payload into the 'out' parameter (e.g., '<script>alert(1)</script>').
4. Attacker uses social engineering or phishing to trick an authenticated or targeted user into clicking the malicious link.
5. The victim's browser requests the endpoint with the injected script.
6. The Ourphp application reflects the unsanitized payload back to the victim's browser.
7. The browser executes the injected script in the context of the user's active session, enabling token theft or forced actions.

Impact

Successful exploitation of CVE-2023-30212 enables an attacker to execute arbitrary scripts in the victim's browser session. This can lead to the compromise of user sessions, theft of sensitive information (such as session cookies or CSRF tokens), and the potential to perform unauthorized administrative actions if the victim is an authorized user. The vulnerability is network-accessible and requires user interaction, making it a viable target for credential-harvesting or session-hijacking campaigns.

Recommendation

• Prioritize upgrading all instances of Ourphp to a version beyond 7.2.0, as there is currently no evidence of an official patch release for this specific legacy version mentioned in the source material.
• Deploy the Sigma rule below to monitor for exploitation attempts targeting the identified endpoint in web server logs.
• Implement Content Security Policy (CSP) headers to mitigate the impact of reflected XSS by restricting where scripts can be loaded and executed.
• Educate users on the risks of clicking suspicious links, especially those directing to internal administrative portals.