CVE-2022-42753

Summary

SalonERP version 3.0.2 allows an external attacker to steal the cookie of arbitrary users. This is possible because the application does not correctly validate the page parameter against XSS attacks.

Affected Software

Weaknesses

• Reflected cross-site scripting (XSS)

ADP Enrichment

CVE Program Container

Additional References

• https://salonerp.sourceforge.io/
• https://fluidattacks.com/advisories/hardway/

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://salonerp.sourceforge.io/
• https://fluidattacks.com/advisories/hardway/

• ←Previous
• Next→