CVE-2022-29362
Description
A cross-site scripting (XSS) vulnerability in /navigation/create?ParentID=%23 of ZKEACMS v3.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ParentID parameter.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ZKEACMS.PublisherNuGet | <= 2.0.0 | — |
Affected products
2- ZKEACMS/ZKEACMSdescription
Patches
Vulnerability mechanics
Root cause
"Missing input sanitization on the ParentID parameter allows stored cross-site scripting in the navigation creation endpoint."
Attack vector
An attacker sends a crafted HTTP request to `/navigation/create?ParentID=%23` with a malicious payload in the `ParentID` parameter [ref_id=1]. Because the application does not neutralize user-controllable input before placing it into the generated web page, the injected script executes in the context of another user's browser when they view the affected navigation item [CWE-79]. No authentication or special network position is required beyond access to the CMS backend interface.
Affected code
The vulnerability exists in the `NavigationService` class within `src/ZKEACMS/Common/Service/NavigationService.cs`. The `Add`, `Update`, `AddRange`, and `UpdateRange` methods did not sanitize the `Title` or `Html` properties of `NavigationEntity` objects before persisting them [patch_id=1702746]. The `ParentID` parameter on the `/navigation/create` endpoint is the injection point [ref_id=1].
What the fix does
The patch injects an `IHtmlSanitizer` dependency into `NavigationService` and calls `_htmlSanitizer.Sanitize()` on both `item.Title` and `item.Html` inside a new private `Santize` method [patch_id=1702746]. This sanitizer is invoked in every `Add`, `AddRange`, `Update`, and `UpdateRange` override before the entity is persisted, stripping or encoding dangerous HTML/script content. The commit message is "Sanitize Html" and references issue #457 [patch_id=1702746][ref_id=3].
Preconditions
- networkAttacker must have access to the ZKEACMS backend navigation creation interface
- authNo special authentication role is mentioned as a barrier in the advisory
- inputThe ParentID parameter is user-controllable via query string
Generated on May 23, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
4- github.com/advisories/GHSA-hc72-vj3g-5g2gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2022-29362ghsaADVISORY
- github.com/SeriaWei/ZKEACMS/commit/833c5460dc5c6152092f6ad54b8b832870a59903ghsaWEB
- github.com/SeriaWei/ZKEACMS/issues/457ghsax_refsource_MISCWEB
News mentions
0No linked articles in our index yet.