PT-2022-14158 · Unknown · Home Clean Services Management System

Webraybtl · Published 2022-05-24 · Updated 2022-06-02 · CVE-2022-1840

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Home Clean Services Management System version 1.0

Description A problematic issue has been found in the software, affecting the "register.php?link=registerand" endpoint. The manipulation with the input <script>alert(1)</script> leads to cross-site scripting. The attack may be initiated remotely but demands authentication. Exploit details have been disclosed to the public.

Recommendations For Home Clean Services Management System version 1.0, consider disabling the register.php endpoint until a patch is available to prevent cross-site scripting attacks. Restrict access to the register.php?link=registerand endpoint to minimize the risk of exploitation. Avoid using user-inputted data in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1840

Affected Products

Home Clean Services Management System

References · 6

• 🔥 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/Home%20Clean%20Services%20Management%20System%20Stored%20Cross-Site%20Scripting%28XSS%29.md · Exploit
• 🔥 https://github.com/Xor-Gerke/webray.com.cn/blob/main/cve/Home%20Clean%20Services%20Management%20System/Home%20Clean%20Services%20Management%20System%20Stored%20Cross-Site%20Scripting(XSS).md · Exploit
• https://osv.dev/vulnerability/CVE-2022-1840 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1840 · Security Note
• https://t.me/cibsecurity/43230 · Telegram Post
• https://vuldb.com/?id.200585 · Note