CVE-2022-40047

MEDIUMNuclei

Flatpress < v1.2.1 - Cross Site Scripting

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-40047 has a selected CVSS score of 5.4 (medium); EIP currently links 1 Nuclei template.

Description

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryMEDIUMFlatpress < v1.2.1 - Cross Site ScriptingCVSS 5.4

Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.

Impact

Authenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration.

Remediation

Update Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php.

WeaknessesCWE-79
Authorsr3Y3r53
Template tagscvecve2022flatpressauthenticatedxssintrusivevuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
CPE: cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*
Shodan: http.html:"flatpress"
Shodan: http.favicon.hash:-1189292869
FOFA: body="flatpress"
FOFA: icon_hash=-1189292869
https://nvd.nist.gov/vuln/detail/CVE-2022-40047 https://github.com/flatpressblog/flatpress/issues/153 http://flatpress.com/

Source: ProjectDiscovery

References

3