PT-2022-20987 · Unknown · Online Discussion Forum Site

Published 2022-06-16 · Updated 2025-04-22 · CVE-2022-31913

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Online Discussion Forum Site version 1.0

Description The issue is related to Cross Site Scripting (XSS) via the "/odfs/classes/Master.php?f=save category" API endpoint, specifically affecting the name variable. This allows for potential malicious script execution.

Recommendations For Online Discussion Forum Site version 1.0, consider disabling the save category function in the Master.php file until a patch is available to prevent exploitation via the "/odfs/classes/Master.php?f=save category" endpoint. Restrict access to this endpoint to minimize the risk of XSS attacks. Avoid using the name variable in this endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-31913

Affected Products

Online Discussion Forum Site

References · 6

• 🔥❌ https://github.com/mikeccltt/0525/blob/main/online-discussion-forum-site/xss.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-31913 · Security Note
• https://osv.dev/vulnerability/CVE-2022-31913 · Vendor Advisory
• https://t.me/cvenotify/32221 · Telegram Post
• https://t.me/cibsecurity/44632 · Telegram Post
• https://t.me/cvenotify/119354 · Telegram Post