PT-2022-20141 · Unknown · Oretnom23 Automotive Shop Management System

N1_X · Published 2022-05-26 · Updated 2022-06-03 · CVE-2022-30494

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions oretnom23 Automotive Shop Management System version 1.0

Description The issue concerns a stored XSS Injection Vulnerability in the first and last name user fields, allowing remote attackers to gain admin access and view internal IPs.

Recommendations For oretnom23 Automotive Shop Management System version 1.0, consider temporarily restricting access to the first name and last name fields until a patch is available to prevent exploitation of the stored XSS Injection Vulnerability. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-30494

Affected Products

Oretnom23 Automotive Shop Management System

References · 4

• 🔥 https://github.com/nsparker1337/OpenSource/blob/main/exploit_xss_asms.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-30494 · Security Note
• https://osv.dev/vulnerability/CVE-2022-30494 · Vendor Advisory
• https://t.me/cvenotify/31085 · Telegram Post