CVE-2022-42100 - KLiK SocialMediaWebsite 1..1 Suffers from Stored XSS in Location Input on Reply Form

In the fast-evolving world of social networks, security vulnerabilities often arise due to improper input validation. KLiK SocialMediaWebsite version 1..1 was found to have a simple, yet impactful critical issue: a stored cross-site scripting (XSS) vulnerability. If you’re using or developing for KLiK SocialMediaWebsite, understanding this hole is important for safeguarding your users and your platform.

This post breaks down CVE-2022-42100, walks you through the exploit, and shows you how an attacker can store malicious scripts via the reply-form’s “location” input. Simple code examples and helpful reference links are included.

What is CVE-2022-42100?

CVE-2022-42100 is the assigned identifier for a vulnerability in KLiK SocialMediaWebsite, version 1..1. Attackers are able to inject malicious JavaScript code into the “location” field on the reply form. Since the input is not sanitized or escaped, malicious scripts are saved (stored) in the database, and served up to every user who views the reply.

How the Attack Works

The location input field is meant for users to indicate where they're posting from. Normally, you expect something like “New York, NY.” However, because user input is not properly cleaned, attackers can inject code instead.

`html

Consider the vulnerable PHP handling from the reply form

<?php
    // ... other code ...
    $location = $_POST['location'];
    // Save input directly to the database, no filter or escaping!
    $db->query("INSERT INTO replies (content, location) VALUES ('$content', '$location')");
    // ... other code ...
?>

<!-- Later, displaying the reply: -->
<div class="reply-location">Location: <?= $reply['location'] ?></div>

The code above outputs raw user input directly into HTML. So if somebody enters

<script>alert('Hacked!')</script>

That code actually runs when any user visits that page.

`

Submit the form.

Now, every time someone loads the reply, their session cookie (or other private info) can be sent to the attacker.

Below are a couple of simple payloads anyone could try if the site’s not fixed

<script>alert('XSS is here!')</script>

Or, for a less obvious payload

<img src=x onerror=alert('PWNED')>

*Note: DO NOT try these on live sites unless you have permission!*

Impact

- Any user could be affected: The script is executed in other users' browsers, not just the attacker’s.

Site defacement: Scripts can alter the appearance or behavior of the site for everyone.

- Chain into bigger attacks: Combined with other flaws, this kind of XSS can be used for privilege escalation.

Official References & Original Discovery

- CVE-2022-42100 at cvedetails.com
- Exploit-DB Entry
- Original Security Advisory

Always use functions like htmlspecialchars() in PHP when producing user content

<div class="reply-location">Location: <?= htmlspecialchars($reply['location'], ENT_QUOTES, 'UTF-8') ?></div>

Reject or clean up input at the time of submission

$location = strip_tags($_POST['location']);
// or, for stricter: allow only certain characters
$location = preg_replace('/[^a-zA-Z-9 ,.-]/', '', $_POST['location']);

Conclusion

Stored XSS, like the one in CVE-2022-42100, is dangerous and easy to exploit. Because user input wasn't sanitized or escaped, attackers are able to inject scripts through the location field of the reply form and potentially compromise user accounts.

Simple steps can prevent this: always escape output and check your inputs.

If you’re running KLiK SocialMediaWebsite 1..1, update or patch your code immediately. Educate your users and team members about how to spot XSS issues. Secure coding saves everyone time and trouble.

Timeline

Published on: 11/29/2022 04:15:00 UTC
Last modified on: 11/30/2022 04:59:00 UTC