PT-2022-27310 · Unknown · Appalti & Contratti

Published 2022-11-21 · Updated 2025-04-29 · CVE-2022-44787

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Appalti & Contratti version 9.12.2

Description The web application is vulnerable to a Reflected Cross-Site Scripting issue. The idPagina parameter is reflected inside the server response without any HTML encoding, resulting in XSS when the victim moves the mouse pointer inside the page. For example, the onmouseenter attribute is not sanitized.

Recommendations For Appalti & Contratti version 9.12.2, consider disabling the reflection of the idPagina parameter in the server response or ensure proper HTML encoding to prevent XSS attacks. As a temporary workaround, restrict access to the affected web application until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2022-44787

Affected Products

Appalti & Contratti

References · 6

• 🔥 https://members.backbox.org/maggioli-appalti-contratti-multiple-vulnerabilities · Exploit
• https://osv.dev/vulnerability/CVE-2022-44787 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-44787 · Security Note
• https://t.me/cvenotify/120217 · Telegram Post
• https://t.me/cvenotify/38176 · Telegram Post
• https://t.me/cibsecurity/53292 · Telegram Post