PT-2022-14243 · Unknown · Fast Food Ordering System

Cyberthoth · Published 2022-06-03 · Updated 2022-06-14 · CVE-2022-1991

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Fast Food Ordering System version 1.0

Description A problematic issue has been discovered, affecting the Master.php file of the Master List. The manipulation of the Description argument with the input foo "><img src="" onerror="alert(document.cookie)"> leads to cross-site scripting. This issue can be exploited remotely, but authentication is required. Exploit details are publicly available.

Recommendations For Fast Food Ordering System version 1.0, consider disabling the Description argument in the Master.php file until a patch is available to prevent cross-site scripting attacks. Restrict access to the Master List to minimize the risk of exploitation. Avoid using the Description argument in the affected file until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-1991

Affected Products

Fast Food Ordering System

References · 5

• 🔥 https://cyberthoth.medium.com/fast-food-ordering-system-1-0-cross-site-scripting-7927f4b1edd6 · Exploit
• https://osv.dev/vulnerability/CVE-2022-1991 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-1991 · Security Note
• https://t.me/cibsecurity/43920 · Telegram Post
• https://vuldb.com/?id.201276 · Note