Miggo Logo
Miggo Vulnerability Database
→
CVE-2016-15022

CVE-2016-15022: CImage Cross-site Scripting vulnerability

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2016-15022
GHSA ID
GHSA-6hv3-9fqx-8pg5
EPSS Score
0.1434%
CWE
CWE-79
Published
1/29/2023
Updated
10/20/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
mos/cimagecomposer< 0.7.190.7.19

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability exists in the inline code of the file 'webroot/check_system.php', specifically in the line where the $_SERVER['SERVER_SOFTWARE'] variable is directly echoed without proper sanitization. The patch adds htmlentities() to neutralize the input. However, this vulnerability does not stem from a specific function but from the lack of output encoding in the script's inline code. Since no user-defined functions are involved in the vulnerable code path, no specific functions are identified as vulnerable with high confidence.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* vuln*r**ility w*s *oun* in mos*t* *im*** up to *.*.**. It **s ***n ***l*r** *s pro*l*m*ti*. *****t** *y t*is vuln*r**ility is *n unknown *un*tion*lity o* t** *il* ****k_syst*m.p*p. T** m*nipul*tion o* t** *r*um*nt $_S*RV*R['S*RV*R_SO*TW*R*'] l***s

Reasoning

T** vuln*r**ility *xists in t** inlin* *o** o* t** *il* 'w**root/****k_syst*m.p*p', sp**i*i**lly in t** lin* w**r* t** $_S*RV*R['S*RV*R_SO*TW*R*'] v*ri**l* is *ir**tly ***o** wit*out prop*r s*nitiz*tion. T** p*t** ***s *tml*ntiti*s() to n*utr*liz* t*