CVE-2022-30494

Vulnerability

A stored Cross-Site Scripting (XSS) vulnerability exists in oretnom23 Automotive Shop Management System v1.0 [1]. The first name and last name user fields on the profile page do not sanitize input, allowing an attacker to inject arbitrary JavaScript [1]. The code path is reachable by any authenticated user navigating to the profile page.

Exploitation

An attacker must first be logged in as a regular user. They then navigate to the profile page and enter a malicious payload (e.g., ">) into either the first name or last name field [1]. When an administrator views the attacker's details, the injected script executes in the admin's browser [1]. No additional privileges or user interaction beyond viewing is required.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of an authenticated admin session [1]. This can lead to session hijacking, admin account takeover, and disclosure of internal IP addresses [1]. The attacker gains full admin access to the application.

Mitigation

No official fix has been released as of the publication date [1]. The vendor (oretnom23) has not provided a patch or workaround [1]. Users should consider restricting access to the management system or implementing a Web Application Firewall (WAF) to filter XSS payloads.