CVE-2022-41358

Vulnerability

Garage Management System v1.0, a PHP/MySQL application [2], is vulnerable to stored cross-site scripting (XSS) in the categoriesName parameter of /garage/php_action/createCategories.php. The application relies only on client-side validation to prevent XSS; no server-side sanitization is applied, allowing arbitrary payloads to be stored and executed when the category list is viewed [1][3][4].

Exploitation

An attacker with network access to the web interface can bypass client-side validation by intercepting the category creation request (e.g., via Burp Suite) and modifying the categoriesName parameter to include a malicious script, such as `` [3][4]. The crafted payload is then sent to the server and stored. Any user who subsequently loads the categories page will execute the script. The attack does not require authentication beyond normal application access.

Impact

Successful exploitation enables arbitrary client-side script execution in the context of the browser of any user viewing the affected categories. This can lead to session hijacking, credential theft, or defacement. The attacker gains no server-side access but can fully control the user's browser session within the application.

Mitigation

As of the available references, no official patch or fixed version has been released; the vendor has not addressed the vulnerability [2]. Since the application relies solely on client-side validation, server-side input sanitization and output encoding must be implemented to remediate the issue. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.