PT-2022-25825 · Unknown · Garage Management System

Sam Wallace · Published 2022-10-20 · Updated 2025-05-08 · CVE-2022-41358

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Garage Management System version 1.0

Description A stored cross-site scripting (XSS) issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the categoriesName parameter in "createCategories.php".

Recommendations For Garage Management System version 1.0, consider disabling the categoriesName parameter in the "createCategories.php" file until a patch is available to prevent exploitation. Restrict access to the "createCategories.php" file to minimize the risk of arbitrary web script execution. Avoid using the categoriesName parameter in the affected endpoint until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41358

Affected Products

Garage Management System

References · 12

• 🔥 https://samwallace.dev/research/Stored%20XSS%20in%20GMS%201.0 · Exploit
• 🔥 http://packetstormsecurity.com/files/168718/Garage-Management-System-1.0-Cross-Site-Scripting.html · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2022100037 · Exploit
• 🔥 https://exploit-db.com/exploits/52238 · Exploit
• 🔥 https://github.com/thecasual/CVE-2022-41358 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-41358 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41358 · Vendor Advisory
• https://t.me/cvenotify/121376 · Telegram Post
• https://sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html · Note
• https://twitter.com/syedaquib77/status/1912602985894670562 · Twitter Post
• https://vulmon.com/vulnerabilitydetails?qid=CVE-2022-41358 · Note
• https://t.me/cibsecurity/51861 · Telegram Post