CVE-2022-29316

CRITICALNuclei

Complete Online Job Search System 1.0 - Cross-Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-29316 has a selected CVSS score of 9.8 (critical); EIP currently links 1 Nuclei template.

Description

Complete Online Job Search System v1.0 was discovered to contain a SQL injection vulnerability via /eris/index.php?q=result&searchfor=advancesearch.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHComplete Online Job Search System 1.0 - Cross-Site ScriptingCVSS 7.2

Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch.

Impact

Attackers can inject malicious JavaScript through the search functionality, potentially stealing session cookies and credentials from job seekers and employers using the platform.

Remediation

Update Complete Online Job Search System to a patched version that properly sanitizes search parameters and encodes output to prevent XSS attacks.

WeaknessesCWE-79
Authorsarafatansari
Template tagscvecve2022xsserissqlivuln
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
https://github.com/debug601/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-9.md https://nvd.nist.gov/vuln/detail/CVE-2022-29316

Source: ProjectDiscovery

References

3