PT-2022-25873 · Unknown · Picuploader

Enferaso · Published 2022-10-07 · Updated 2022-10-11 · CVE-2022-41442

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions PicUploader version 2.6.3

Description A cross-site scripting (XSS) issue was found in the setStorageParams function within SettingController.php.

Recommendations For PicUploader version 2.6.3, update the SettingController.php file to fix the setStorageParams function, ensuring proper input validation and sanitization to prevent XSS attacks.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-41442

Affected Products

Picuploader

References · 4

• 🔥 https://github.com/xiebruce/PicUploader/issues/80 · Exploit
• https://github.com/xiebruce/PicUploader/commit/2b0411bddb7942e0ace136a82d4ccde0fe66f263 · Patch
• https://osv.dev/vulnerability/CVE-2022-41442 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41442 · Security Note