// For flags

CVE-2022-3942

SourceCodester Sanitization Management System cross site scripting

Severity Score

6.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A vulnerability was found in SourceCodester Sanitization Management System and classified as problematic. This issue affects some unknown processing of the file php-sms/?p=request_quote. The manipulation leads to cross site scripting. The attack may be initiated remotely. The identifier VDB-213449 was assigned to this vulnerability.

Una vulnerabilidad fue encontrada en SourceCodester Sanitization Management System y clasificada como problemática. Este problema afecta un procesamiento desconocido del archivo php-sms/?p=request_quote. La manipulación conduce a Cross-Site Scripting (XSS). El ataque puede iniciarse de forma remota. A esta vulnerabilidad se le asignó el identificador VDB-213449.

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of HP LaserJet Pro MFP M283fdw printers. Authentication is not required to exploit this vulnerability.
The specific flaw exists within the implementation of the LLMNR protocol. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.

*Credits: Angelboy (@scwuaptx) from DEVCORE Research Team
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
Low
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Adjacent
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-03-23 CVE Published
  • 2022-11-11 CVE Reserved
  • 2022-11-20 First Exploit
  • 2024-06-03 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
  • CWE-707: Improper Neutralization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Sanitization Management System Project
Search vendor "Sanitization Management System Project"
 Sanitization Management System
Search vendor "Sanitization Management System Project" for product "Sanitization Management System"
--
Affected