CVE-2022-38553

MEDIUMNuclei

Academy Learning Management System <5.9.1 - Cross-Site Scripting

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-38553 has a selected CVSS score of 6.1 (medium); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

Academy Learning Management System before v5.9.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated May 21, 2025 · Source: CVE List

Proofs of concept

1

Repository PoCs

GitHub4websecurity/CVE-2022-38553Repository PoCby 4websecurity2Not analyzed2 files

35.8 KiB

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryMEDIUMAcademy Learning Management System <5.9.1 - Cross-Site ScriptingCVSS 6.1

Academy Learning Management System before 5.9.1 contains a cross-site scripting vulnerability via the Search parameter. An attacker can inject arbitrary script in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Impact

Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.

Remediation

Upgrade to Academy Learning Management System version 5.9.1 or later to mitigate the XSS vulnerability.

WeaknessesCWE-79
Authorsedoardottt
Template tagscve2022cveacademylmsxsscreativeitemvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:creativeitem:academy_learning_management_system:*:*:*:*:*:*:*:*
Shodan: http.html:"study any topic, anytime"
FOFA: body="study any topic, anytime"
Google: intext:"Study any topic, anytime"
Google: intext:"study any topic, anytime"
https://www.youtube.com/watch?v=yFiZffHoeKs&ab_channel=4websecurity https://github.com/4websecurity/CVE-2022-38553 https://codecanyon.net/item/academy-course-based-learning-management-system/22703468 https://nvd.nist.gov/vuln/detail/CVE-2022-38553 http://academy.com/

Source: ProjectDiscovery

References

7