Zoo Management System Content Module cross site scripting

An attacker can exploit this XSS vulnerability by injecting malicious JavaScript code through the adminname parameter in the /zoo/admin/publichtml/view_accounts?type=zookeeper endpoint. Successful exploitation allows the attacker to execute arbitrary JavaScript code in the context of the user's browser session. This could lead to session hijacking, unauthorized access to sensitive data, defacement of the application, or redirection to malicious websites. The impact is particularly severe if the administrator account is targeted, as this could grant the attacker full control over the Zoo Management System.

Organizations utilizing the Zoo Management System 1.0, particularly those with administrative interfaces accessible over the internet, are at risk. Shared hosting environments where multiple users share the same instance of the Zoo Management System are also particularly vulnerable, as an attacker could potentially compromise other users' accounts.

1. 2022-05-23Disclosure

   disclosure

1. 已保留2022-05-23
2. 发布日期2022-05-23
3. 修改日期2024-10-15
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2022-1816 is to upgrade to a patched version of the Zoo Management System when available. Until a patch is released, implement input sanitization on the adminname parameter to prevent the injection of malicious scripts. This can be achieved by using a web application firewall (WAF) with XSS filtering rules or by implementing server-side validation to ensure that the input only contains expected characters. Additionally, consider restricting access to the /zoo/admin/publichtml/view_accounts?type=zookeeper endpoint to authorized users only.