VYPR
← All advisories
Moderate severityNVD Advisory· Published Jun 21, 2022· Updated Aug 3, 2024

CVE-2022-30874

CVE-2022-30874

Description

There is a Cross Site Scripting Stored (XSS) vulnerability in NukeViet CMS before 4.5.02.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Stored XSS in NukeViet CMS before 4.5.02 allows attackers to inject arbitrary scripts via a crafted submit button, bypassing sanitization.

A stored cross-site scripting (XSS) vulnerability exists in NukeViet CMS prior to version 4.5.02 [2]. The root cause is a flaw in the JavaScript function btnClickSubmit which sanitizes inputs before form submission. The function is triggered only for submit buttons without a name attribute. However, attackers can craft a submit button with name="submit" to bypass the sanitization logic [4].

To exploit this vulnerability, an attacker must have the ability to submit content that is stored and later displayed to other users (e.g., comments, articles, or user profiles). By injecting a malicious script combined with a submit button having name="submit", the attacker can cause the script to be stored without sanitization. When another user views the affected page, the script executes in their browser [2].

The impact is typical of stored XSS: an attacker can execute arbitrary JavaScript in the context of the victim's session. This can lead to session cookie theft, account takeover, defacement of the website, or redirection to phishing sites.

The vulnerability is fixed in NukeViet version 4.5.02, which includes a patch that ensures the sanitization function is called regardless of the submit button's name attribute [4]. Users are strongly advised to upgrade to the latest version to mitigate the risk.

References
  1. Thông báo phát hành NukeViet 4.5.02
  2. Không tự động xóa mã XSS khi có name=submit · nukeviet/nukeviet@1f328bb

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
nukeviet/nukevietPackagist
< 4.5.024.5.02

Affected products

2

Patches

1
1f328bb8cd25

Không tự động xóa mã XSS khi có name=submit

https://github.com/nukeviet/nukevietNguyen Anh TuJun 17, 2022via ghsa
commit
2 files changed · +8 −2
  • assets/js/site.js+4 −1 modified
    @@ -24,6 +24,9 @@ function btnClickSubmit(event, form) {
 
 $(function() {
     $('body').on('click', '[type=submit]:not([name])', function(e) {
-        btnClickSubmit(e, $(this).parents('form'))
+        var form = $(this).parents('form');
+        if (!$('[name=submit]', form).length) {
+            btnClickSubmit(e,form)
+        }
     });
 })
  • themes/admin_default/js/main.js+4 −1 modified
    @@ -187,7 +187,10 @@ $(document).ready(function() {
 
     //XSSsanitize
     $('body').on('click', '[type=submit]:not([name])', function(e) {
-        btnClickSubmit(e, $(this).parents('form'))
+        var form = $(this).parents('form');
+        if (!$('[name=submit]', form).length) {
+            btnClickSubmit(e,form)
+        }
     });
 
     $(document).on('click', function(e) {

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

6

News mentions

0

No linked articles in our index yet.