CVE-2024-23855

Name of the Vulnerable Software and Affected Versions Cups Easy (Purchase & Inventory) version 1.0

Description A vulnerability has been reported in Cups Easy (Purchase & Inventory) whereby user-controlled inputs are not sufficiently encoded, resulting in a Cross-Site Scripting (XSS) vulnerability via "/cupseasylive/taxcodemodify.php", in multiple parameters. Exploitation of this vulnerability could allow a remote attacker to send a specially crafted URL to an authenticated user and steal their session cookie credentials.

Recommendations For version 1.0, consider disabling access to the "/cupseasylive/taxcodemodify.php" endpoint until a patch is available to prevent exploitation of the Cross-Site Scripting (XSS) vulnerability. Additionally, restrict the use of user-controlled inputs in multiple parameters to minimize the risk of session cookie credentials theft.