CVE-2022-45214

Vulnerability

A cross-site scripting (XSS) vulnerability exists in Sanitization Management System v1.0.0, specifically within the /php-sms/classes/Login.php script. The application fails to sanitize user input supplied through the username parameter, allowing an attacker to inject arbitrary web scripts or HTML [1]. The vulnerable endpoint is the login page, which is reachable without prior authentication.

Exploitation

An attacker can exploit this vulnerability by crafting a malicious payload (e.g., `) and inserting it into the username` parameter of a login request. The payload is then executed in the browser of any user who visits the crafted URL, requiring no special privileges or prior authentication [1]. No user interaction beyond clicking the link is necessary for the attack to succeed.

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the context of the victim's browser. This can lead to session hijacking, defacement, or theft of sensitive information (e.g., cookies or credentials) displayed within the session [1]. The attack is limited to the browser session and does not grant server-side access.

Mitigation

As of the publication date (November 28, 2022), no patched version has been released by the vendor [1]. Users must implement input validation and output encoding for the username parameter. CSRF tokens and Content Security Policy (CSP) headers can also help mitigate the risk. The product has no known entry on the CISA KEV list.