PT-2022-17772 · Unknown · Online Project Time Management System

Published 2022-03-16 · Updated 2022-03-28 · CVE-2022-26295

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Online Project Time Management System version 1.0

Description A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the user name field in the "/ptms/?page=user" API endpoint.

Recommendations For Online Project Time Management System version 1.0, consider disabling the user name field in the "/ptms/?page=user" endpoint until a patch is available to prevent exploitation. Restrict access to this endpoint to minimize the risk of arbitrary web script execution. Avoid using the user name field in the affected API endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-26295

Affected Products

Online Project Time Management System

References · 4

• 🔥 https://exploit-db.com/exploits/50683 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-26295 · Security Note
• https://osv.dev/vulnerability/CVE-2022-26295 · Vendor Advisory
• https://t.me/cibsecurity/39108 · Telegram Post