PT-2022-24053 · Ftcms · Ftcms

Published 2022-09-07 · Updated 2022-09-13 · CVE-2022-37731

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ftcms version 2.1

Description The issue allows an attacker to insert malicious JavaScript code into the web page, causing the user or administrator to trigger malicious code when accessing. This is a result of a XSS vulnerability in the poster.PHP file.

Recommendations For ftcms version 2.1, consider disabling the poster.PHP file or restricting access to it until a fix is available to prevent exploitation of the XSS vulnerability.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-37731

Affected Products

Ftcms

References · 4

• 🔥❌ https://github.com/whiex/webvue2/blob/gh-pages/ftcmsxss.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-37731 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-37731 · Security Note
• https://t.me/cvenotify/35811 · Telegram Post