PT-2022-20674 · Haraj · Haraj

Abdulaziz Saad + 1 · Published 2022-06-16 · Updated 2022-06-27 · CVE-2022-31299

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Haraj version 3.7

Description A reflected cross-site scripting (XSS) issue was found in the User Upgrade Form. This could potentially allow attackers to inject malicious scripts into the website, affecting users who interact with the compromised form.

Recommendations For Haraj version 3.7, update the User Upgrade Form to properly sanitize user input and prevent XSS attacks. As a temporary workaround, consider restricting access to the User Upgrade Form until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31299

Affected Products

Haraj

References · 6

• 🔥 https://github.com/bigzooooz/CVE-2022-31299 · Exploit
• https://osv.dev/vulnerability/CVE-2022-31299 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31299 · Security Note
• https://angtech.org · Note
• https://t.me/cibsecurity/44696 · Telegram Post
• https://angtech.org/product/view/3 · Note