LiveActive security incident?Get immediate response
CVE Record

CVE-2023-3858: phpscriptpoint Car Listing search.php cross site scripting

A vulnerability has been found in phpscriptpoint Car Listing 1.6 and classified as problematic. This vulnerability affects unknown code of the file /search.php. The manipulation of the argument country/state/city leads to cross site scripting. The attack can be initiated remotely. VDB-235210 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

MediumCVSS 4Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2023-3858 is a cross-site scripting issue in phpscriptpoint Car Listing 1.6. An attacker can manipulate search fields to run script in a user's browser. Business risk is moderate: it can support session abuse or misleading content, but the CVSS vector indicates no confidentiality or availability impact.

Executive priority

Treat as a moderate web application risk. Prioritize if the product is internet-facing, customer-accessible, or unsupported, because vendor response and patch status are not established in the sources.

Technical view

The issue affects /search.php in phpscriptpoint Car Listing 1.6. Manipulation of country, state, or city arguments leads to CWE-79 cross-site scripting. The CVSS v2 vector is AV:N/AC:L/Au:S/C:N/I:P/A:N, indicating network reachability, low complexity, and authenticated access.

Likely exposure

Exposure is likely limited to organizations running phpscriptpoint Car Listing 1.6 with /search.php reachable. The CVSS vector indicates authentication is required. No CPEs were supplied.

Exploitation context

Sources say the attack can be initiated remotely, but the bundle does not cite active exploitation and KEV is false. Vendor contact reportedly received no response, so fix availability is unclear.

Researcher notes

Evidence identifies affected parameters and endpoint but not exact vulnerable code, patch details, or real-world exploitation. The CVSS v2 authentication requirement should be validated against local deployment behavior.

Mitigation direction

  • Inventory any phpscriptpoint Car Listing deployments and confirm whether version 1.6 is present.
  • Check vendor or maintainer guidance before assuming a patch exists.
  • If self-maintained, validate and safely encode country, state, and city output paths.
  • Restrict access to affected search functionality if the application cannot be fixed promptly.
  • Consider retiring or replacing unsupported exposed installations.

Validation and detection

  • Confirm whether /search.php is reachable on deployed Car Listing instances.
  • Verify the deployed product version against phpscriptpoint Car Listing 1.6.
  • Review application code handling country, state, and city parameters.
  • Check web logs for unusual search parameter activity.
  • Use safe, non-destructive XSS validation in an authorized test environment.
Prepared
Confidence
medium
Sources
4

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · medium confidence lookup

CWE-79: User-session and phishing behavior lookup

Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2023-3858 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Medium
CVSS
4 (2.0)
Known Exploited
No
Published

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
0Timeline events
0ADP providers
3Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
4CVSS 2.0MediumAV:N/AC:L/Au:S/C:N/I:P/A:N82.9Primary CVE score

Vulnerability scoring details

Base CVSS 2.0 score

4Medium
CVSS 2.0 vector shape for CVE-2023-3858Access VectorAccess ComplexityAuthenticationConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: AV:N/AC:L/Au:S/C:N/I:P/A:N

Access Vector
NetworkAdjacentLocal
Access Complexity
LowMediumHigh
Authentication
NoneSingleMultiple
Confidentiality Impact
CompletePartialNone
Integrity Impact
CompletePartialNone
Availability Impact
CompletePartialNone

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
phpscriptpointCar Listing1.6Listed
Weakness

CWE details

CWE-79

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.