CVE-2024-23860

Summary

CVE-2024-23860 is a newly identified vulnerability affecting Cups Easy (Purchase & Inventory), version 1.0. The issue arises due to insufficient encoding of user-controlled inputs, leading to a Cross-Site Scripting (XSS) vulnerability. Specifically, the vulnerability can be exploited via the /cupseasylive/currencylist.php file, in the description parameter. Successful exploitation enables a remote attacker to craft a malicious URL and steal session cookie credentials from an authenticated user.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.