CVE-2022-1816: XSS in Zoo Management System Content Module

An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code through the adminname parameter in the /zoo/admin/publichtml/view_accounts?type=zookeeper endpoint. Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the user's browser session. This could lead to session hijacking, unauthorized access to sensitive data, defacement of the application, or redirection to malicious websites. The impact is particularly severe if the administrator account is targeted, as this could grant the attacker full control over the Zoo Management System.

1. Reserved2022-05-23
2. Published2022-05-23
3. Modified2024-10-15
4. EPSS updated2026-04-02

The primary mitigation for CVE-2022-1816 is to upgrade to a patched version of the Zoo Management System when available. Until a patch is released, implement input sanitization on the adminname parameter to prevent the injection of malicious scripts. This can be achieved by using a web application firewall (WAF) with XSS filtering rules or by implementing server-side validation to ensure that the input only contains expected characters. Additionally, consider restricting access to the /zoo/admin/publichtml/view_accounts?type=zookeeper endpoint to authorized users only.