medium5.4Public exploit code
CVE-2022-34140
Feehi CMS Cross-site Scripting
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Feehi CMS 2.1.1 - Remote Code Execution (Authenticated)2022-09-23 · webapps · php
- Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)2022-08-09 · webapps · php
Impact
A stored cross-site scripting (XSS) vulnerability in `/index.php?r=site%2Fsignup` of Feehi CMS v2.1.1 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the username field.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | feehi/cms | <= 2.1.1 | none recorded |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Feehi | Feehi Cms | Version 2.1.1 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/168012/Feehi-CMS-2.1.1-Cross-Site-Scripting.html
- http://packetstormsecurity.com/files/168476/Feehi-CMS-2.1.1-Remote-Code-Execution.html
- https://github.com/liufee/cms
- https://github.com/liufee/cms/issues/61
- https://github.com/advisories/GHSA-25q6-m425-9fqr
- https://nvd.nist.gov/vuln/detail/CVE-2022-34140