PT-2022-23896 · Unknown · Crime Reporting System

Published 2022-09-06 · Updated 2022-09-09 · CVE-2022-37253

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Crime Reporting System version 1.0

Description The issue allows a remote attacker to introduce arbitrary Javascript via manipulation of an unsanitized POST parameter, enabling persistent cross-site scripting (XSS) attacks.

Recommendations For Crime Reporting System version 1.0, as a temporary workaround, consider sanitizing the POST parameter to prevent the introduction of malicious Javascript code. Restrict access to the affected module to minimize the risk of exploitation. Avoid using the vulnerable parameter in the affected API endpoint until the issue is resolved.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37253

Affected Products

Crime Reporting System

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2022-37253 · Security Note
• https://osv.dev/vulnerability/CVE-2022-37253 · Vendor Advisory
• https://sourcecodehero.com/crime-reporting-system-project-in-php-with-source-code · Note
• https://packetstormsecurity.com/files/167875/Crime-Reporting-System-1.0-Cross-Site-Scripting.html · Note
• https://t.me/cibsecurity/49383 · Telegram Post