CVE-2022-25869

MEDIUM

angularjs - Cross-Site Scripting via Textarea Interpolation

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-25869. PoCs published by neverendingsupport.

AI-analyzed exploit summary This repository contains a minimal Proof-of-Concept for an AngularJS XSS vulnerability (CVE-2022-25869) affecting Internet Explorer via a `<textarea>` element. The PoC is hosted live for demonstration purposes.

Description

All versions of the package angular; all versions of the package angularjs.core; all versions of the package angularjs are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of <textarea> elements.

Exploits (1)

nomisec WORKING POC 1 stars

by neverendingsupport · poc

https://github.com/neverendingsupport/angularjs-poc-cve-2022-25869

View Code ZIP pw:eip

This repository contains a minimal Proof-of-Concept for an AngularJS XSS vulnerability (CVE-2022-25869) affecting Internet Explorer via a `<textarea>` element. The PoC is hosted live for demonstration purposes.

Classification

Working Poc 90%

Attack Type

Xss

Complexity

Trivial

Reliability

Reliable

Target: AngularJS (versions affected by CVE-2022-25869)

No auth needed

Prerequisites: Target using Internet Explorer · AngularJS application with vulnerable `<textarea>` element

MITRE ATT&CK