CVE-2022-48324: XSS
Multiple Cross Site Scripting (XSS) vulnerabilities in Mapos 4.39.0 allow attackers to execute arbitrary code. Affects the following parameters: (1) pesquisa, (2) data, (3) data2, (4) nome, (5) descricao, (6) idDocumentos, (7) id in file application/controllers/Arquivos.php; (8) senha, (9) nomeCliente, (10) contato, (11) documento, (12) telefone, (13) celular, (14) email, (15) rua, (16) numero, (17) complemento, (18) bairro, (19) cidade, (20) estado, (21) cep, (22) idClientes, (23) id in file application/controllers/Clientes.php; (24) id, (25) tipo, (26) formapagamento, (27) gatewaydepagamento, (28) excluirid, (29) confirmaid, (30) cancelaid in file application/controllers/Cobrancas.php; (31) vencimentode, (32) vencimentoate, (33) cliente, (34) tipo, (35) status, (36) valordesconto, (37) desconto, (38) periodo, (39) perpage, (40) urlAtual, (41) vencimento, (42) recebimento, (43) valor, (44) recebido, (45) formaPgto, (46) descontoparc, (47) entrada, (48) qtdparcelasparc, (49) valorparc, (50) diapgto, (51) diabasepgto, (52) comissao, (53) descricaoparc, (54) clienteparc, (55) observacoesparc, (56) formaPgtoparc, (57) tipoparc, (58) pagamento, (59) pago, (60) valordescontoeditar, (61) descricao, (62) fornecedor, (63) observacoes, (64) id in file application/controllers/Financeiro.php; (65) refGarantia, (66) textoGarantia, (67) idGarantias in file application/controllers/Garantias.php; (68) email, (69) senha in file application/controllers/Login.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The CVSS vector indicates that exploitation can be performed over the network with low attack complexity and requires no privileges. A user must interact with attacker-controlled content, consistent with XSS exploitation.
What is the likely impact of successful exploitation?
Successful exploitation can execute arbitrary code in the affected web application context. The CVSS metrics indicate low confidentiality and integrity impact, no availability impact, and scope change.
Which areas of the application are affected?
The reported vulnerable inputs span multiple controllers, including Arquivos.php, Clientes.php, and Cobrancas.php. Affected parameters include file, customer, billing, payment, search, date, and document-related fields.
What should organizations do to remediate this vulnerability?
A patch is available. Apply the available vendor or project patch to affected Mapos 4.39.0 deployments.