CVE-2023-31546: DedeBIZ search feature cross-site scripting

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityCritical CVSS and very high EPSS with public exploit code, but exploitation requires user interaction and no KEV or ransomware evidence is present.

What it is

DedeBIZ v6.0.3 contains a reflected cross-site scripting flaw in its search feature, tracked as CWE-79. Because the search input is not properly neutralized, an attacker can inject script that executes in a victim's browser. The CVSS 3.1 score is 9.6 (critical), reflecting high confidentiality, integrity and availability impact with scope change.

Impact

An attacker can run arbitrary script in the context of a victim's session, enabling session theft, credential capture, or actions performed as the victim. The scope-change rating means the compromise can extend beyond the vulnerable component.

Attack surface

The flaw is reached over the network through the search feature, requiring no authentication (PR:N) but requiring user interaction (UI:R) for the victim to trigger the crafted input.

Exploitation

No CISA KEV listing and no ransomware association are recorded. EPSS is 0.49362 (98.8th percentile), and the only references are third-party advisories tagged Exploit, indicating public proof-of-concept code exists.

What to do

• Upgrade DedeBIZ past v6.0.3 to a release that fixes the search XSS; no fixed version is stated in this record, so confirm with the vendor.
• If upgrade is not possible, apply input validation and output encoding to the search parameter, and deploy a WAF rule blocking script payloads in search queries.
• Set a restrictive Content-Security-Policy to reduce script execution impact.
• Review and sanitize all other user-supplied parameters in the search flow for the same class of flaw.

Detection

• Search web and proxy logs for script tags, event handlers, or encoded payloads in the search query parameter.
• Alert on reflected input appearing unescaped in HTTP responses from the search endpoint.
• Monitor for anomalous client-side requests or session activity following search page visits.
• Use browser or endpoint telemetry to catch unexpected script execution on DedeBIZ pages.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.