Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-50925. PoCs published by Rik Lutz.
AI-analyzed exploit summary This exploit demonstrates a remote keystroke injection vulnerability in Prowise Reflect v1.0.9 via WebSocket communication on port 8082. It simulates keyboard input to open Notepad and type a message, leveraging a lack of input validation in the WebSocket handler.
Description
Prowise Reflect version 1.0.9 contains a remote keystroke injection vulnerability that allows attackers to send keyboard events through an exposed WebSocket on port 8082. Attackers can craft malicious web pages to inject keystrokes, opening applications and typing arbitrary text by sending specific WebSocket messages.
Exploits (1)
This exploit demonstrates a remote keystroke injection vulnerability in Prowise Reflect v1.0.9 via WebSocket communication on port 8082. It simulates keyboard input to open Notepad and type a message, leveraging a lack of input validation in the WebSocket handler.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H