CVE-2023-30124: 
PHP vulnerability analysis and mitigation

LavaLite v9.0.0 contains a Stored Cross-Site Scripting (XSS) vulnerability that was disclosed on March 22, 2023. The vulnerability allows client users to perform attacks against administrator users by modifying account names with malicious JavaScript code (GitHub Issue).

The vulnerability has been assigned a CVSS v3.1 Base Score of 5.4 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N. It has been classified as CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (NVD).

When successfully exploited, this vulnerability allows attackers to inject malicious JavaScript code that executes in the context of administrator sessions. This can lead to unauthorized actions being performed with administrator privileges, potentially compromising the security of the entire website (GitHub Issue).

The vulnerability can be exploited by authenticated users with client-level access. The attack involves modifying account names with malicious JavaScript code, which is then triggered when administrators view the client list. The exploit has been confirmed to work in version 9.0.0 of LavaLite (GitHub Issue).