Froxlor < 0.10.38.2. - HTML Injection

mediumseverity

6.1CVSS score

1.8%likelihood of exploitation, next 30 days

79%of all CVEs are less likely

Readycheck to confirm it

HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.

Impact

Attackers can inject arbitrary HTML content through the customermail parameter, potentially displaying fake content to users and facilitating phishing attacks against Froxlor administrators.

Fix

Update Froxlor to version 0.10.38.2 or later that properly sanitizes the customermail parameter and encodes HTML output.

How to confirm it

Send: GET {{BaseURL}}/index.php?showmessage=4&customermail="><h2>TEST</h2>
Positive when: contains "The message to \"\"><h2>TEST</h2>\" failed" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2022-3869 -u <target>

The full check

id: CVE-2022-3869

info:
  name: Froxlor < 0.10.38.2. - HTML Injection
  author: ctflearner
  severity: medium
  description: |
    HTML Injection in GitHub repository froxlor/froxlor prior to 0.10.38.2.
  impact: |
    Attackers can inject arbitrary HTML content through the customermail parameter, potentially displaying fake content to users and facilitating phishing attacks against Froxlor administrators.
  remediation: |
    Update Froxlor to version 0.10.38.2 or later that properly sanitizes the customermail parameter and encodes HTML output.
  reference:
    - https://huntr.com/bounties/7de20f21-4a9b-445d-ae2b-15ade648900b
    - https://nvd.nist.gov/vuln/detail/CVE-2022-3869
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-3869
    cwe-id: CWE-79
    epss-score: 0.01832
    epss-percentile: 0.7906
  metadata:
    verified: true
    max-request: 1
    shodan-query: title:"Froxlor"
    product: froxlor
  tags: cve2022,cve,froxlor,html,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?showmessage=4&customermail=\"><h2>TEST</h2>"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'The message to ""><h2>TEST</h2>" failed'

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from