PT-2022-19359 · Unknown · Online Birth Certificate System

Sanjay Singh · Published 2022-05-23 · Updated 2023-11-14 · CVE-2022-29005

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Online Birth Certificate System version 1.2

Description The issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the fname or lname parameters in the /obcs/user/profile.php component. This enables the execution of malicious code on the victim's browser, potentially leading to unauthorized actions or data theft.

Recommendations For Online Birth Certificate System version 1.2, consider validating and sanitizing user input for the fname and lname parameters to prevent malicious code injection. As a temporary workaround, restrict access to the /obcs/user/profile.php component until a patch is available. Avoid using the fname and lname parameters in the affected component until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-29005

Affected Products

Online Birth Certificate System

References · 6

• 🔥 https://github.com/sudoninja-noob/CVE-2022-29005/blob/main/CVE-2022-29005.txt · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29005 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29005 · Vendor Advisory
• https://t.me/cibsecurity/43176 · Telegram Post
• http://online.com · Note
• https://phpgurukul.com/online-birth-certificate-system-using-php-and-mysql · Note