Store XSS in title parameter executing at EditUser Page & EditProducto page in neorazorx/facturascripts

The impact of this XSS vulnerability is significant. An attacker can inject arbitrary JavaScript code into the EditUser and EditProducto pages of facturascripts. This malicious code can then be executed in the context of a user's browser when they visit the affected page. This allows the attacker to steal sensitive information, such as session cookies, and impersonate legitimate users. Furthermore, the attacker could redirect users to malicious websites, deface the application, or even install malware on the user's machine. The potential for data exfiltration and account takeover makes this a high-priority vulnerability to address.

Organizations using facturascripts for invoice generation and management are at risk, particularly those running versions prior to 2022.04. Shared hosting environments where multiple users share the same facturascripts installation are especially vulnerable, as an attacker could potentially compromise other users' accounts through this XSS vulnerability.

• generic web: Use curl to test the EditUser and EditProducto endpoints with a simple XSS payload (e.g., <script>alert(1)</script>) in the 'title' parameter. Examine the response for signs of script execution.

curl 'http://your-facturascripts-instance/edit_user.php?title=<script>alert(1)</script>'

• generic web: Review access logs for requests containing suspicious characters or patterns in the 'title' parameter, such as <script> or javascript:. • php: Examine the source code of edituser.php and editproducto.php for the handling of the 'title' parameter. Look for missing or inadequate input validation and output encoding.

1. 2022-04-25Disclosure

   disclosure

1. 已保留2022-04-25
2. 发布日期2022-04-25
3. 修改日期2024-08-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-1457 is to immediately upgrade facturascripts to version 2022.04 or later. If upgrading is not immediately feasible, consider implementing input validation and output encoding on the 'title' parameter in the EditUser and EditProducto pages. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a temporary layer of protection. Review access logs for suspicious activity, particularly requests containing unusual characters in the 'title' parameter. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) into the 'title' field and verifying that the script is not executed.