Reflected Xss using url based payload in neorazorx/facturascripts

The impact of CVE-2022-1682 is significant due to the ease of exploitation and the potential for severe consequences. An attacker can craft a malicious URL containing a JavaScript payload. When a user clicks on this URL, the script executes in their browser within the context of the facturascripts application. This allows the attacker to steal the user's session cookies, effectively gaining unauthorized access to their account. Beyond account takeover, an attacker could potentially perform actions on behalf of the user, such as modifying data, initiating fraudulent transactions, or spreading malware. The vulnerability's reliance on URL manipulation makes it easily spreadable via phishing campaigns or malicious websites.

Facturascripts users, particularly those running versions prior to 2022.07, are at risk. Shared hosting environments where multiple users share the same server instance are especially vulnerable, as a compromised account could potentially expose other users on the same server. Users who rely on facturascripts for sensitive financial data are at heightened risk.

• php / server:

grep -r 'neorazorx/facturascripts' /var/log/apache2/access.log
grep -r 'javascript:' /var/log/apache2/access.log

• generic web:

curl -I <target_url_with_malicious_payload>

• generic web: Check response headers for unexpected Content-Security-Policy directives.

1. 2022-05-12Disclosure

   disclosure

1. 已保留2022-05-12
2. 发布日期2022-05-12
3. 修改日期2024-08-03
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-1682 is to upgrade facturascripts to version 2022.07 or later, which contains the fix. If immediate upgrading is not possible, consider implementing input validation and output encoding on all user-supplied data used in URL generation. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Regularly review and sanitize user input to prevent malicious code injection.