What is the CVSS score of CVE-2023-44915?

CVE-2023-44915 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2023-44915?

A cross-site scripting vulnerability in c3crm's login component (CVE-2023-44915) allows attackers to inject malicious scripts that execute in users' browsers, potentially compromising credentials and…

How to fix or mitigate CVE-2023-44915?

Within 24 hours: Identify all systems running c3crm v3.0.4 or earlier and assess exposure in your environment. Within 7 days: Deploy Web Application Firewall (WAF) rules to block XSS payloads targeting the login_error parameter; implement input validation and output encoding if accessible; restrict login page access by IP whitelist where feasible. Within 30 days: Monitor c3crm vendor for patch release; evaluate migration to patched version or alternative CRM solution; conduct security audit of login page for additional injection vectors.

PHP CVE-2023-44915

EUVD-2023-49238 HIGH

Cross-site Scripting (XSS) (CWE-79)

2025-06-25 cve@mitre.org

PHP XSS

7.1

CVSS 3.1 · Vendor: mitre

Severity by source

Vendor (mitre) PRIMARY

7.1 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from Vendor (mitre) · only source for this CVE.

CVSS VectorVendor: mitre

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 15, 2026 - 23:19 euvd

EUVD-2023-49238

Analysis Generated

Mar 15, 2026 - 23:19 vuln.today

CVE Published

Jun 25, 2025 - 17:15 nvd

HIGH 7.1

DescriptionCVE.org

A cross-site scripting (XSS) vulnerability in the component /Login.php of c3crm up to v3.0.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the login_error parameter.

AnalysisAI

CVE-2023-44915 is a reflected cross-site scripting (XSS) vulnerability in c3crm's /Login.php component affecting versions up to v3.0.4, where the login_error parameter fails to properly sanitize user input. An attacker can inject malicious JavaScript that executes in victims' browsers when they click a crafted login link, potentially stealing session cookies, credentials, or performing unauthorized actions on behalf of authenticated users. With a CVSS score of 7.1 and network-based attack vector requiring only user interaction, this represents a moderate-to-high severity issue for organizations using vulnerable c3crm deployments.

Technical ContextAI

This is a classic reflected XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) in a PHP-based CRM application. The /Login.php endpoint fails to encode or validate the login_error parameter before reflecting it back in HTML output, allowing an attacker to break out of the current context and inject arbitrary HTML/JavaScript. The vulnerability exists in the presentation layer where user-controlled input is rendered directly to the DOM without sanitization via htmlspecialchars(), htmlentities(), or context-appropriate output encoding. CPE for affected product: cpe:2.3:a:c3crm:c3crm:*:*:*:*:*:*:*:* (versions <=3.0.4). This is a parameter-based injection flaw common in legacy PHP applications that predate secure coding frameworks.

RemediationAI

Upgrade c3crm to version 3.0.5 or later immediately. Contact c3crm vendor or check https://c3crm.com (official vendor site) for security updates. Code-Level Mitigation: In /Login.php, apply context-appropriate output encoding to the login_error parameter: replace unencoded output with htmlspecialchars($login_error, ENT_QUOTES, 'UTF-8') or use a templating engine with auto-escaping (Twig, Blade). Input Validation: Validate and sanitize the login_error parameter server-side: whitelist acceptable characters, enforce maximum length, reject special characters if not required. Content Security Policy: Implement strict CSP headers (e.g., Content-Security-Policy: default-src 'self'; script-src 'self') to mitigate XSS impact even if filtering fails. Workaround (Temporary): If immediate patching is impossible: (1) Restrict access to /Login.php via WAF/firewall rules, (2) Implement rate limiting on login endpoints, (3) Monitor for suspicious login_error parameter patterns, (4) Use reverse proxy to strip or sanitize the parameter.