Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-2066

CVE-2022-2066:
Cross site scripting in facturascripts

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-2066
GHSA ID
GHSA-h6wm-mr85-4h9g
EPSS Score
0.544%
CWE
CWE-79
Published
6/14/2022
Updated
1/27/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
facturascripts/facturascriptscomposer< 2022.062022.06

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unescaped user input in login error messages. The commit diff shows the vulnerability was patched by adding htmlspecialchars() around the $nick variable in AppController::userAuth. This function handles authentication and directly used user-controlled input (fsNick parameter) in a warning message without proper output encoding, making it the clear injection point for reflected XSS attacks when rendering error messages to users.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

* *ross-sit* S*riptin* (XSS) vuln*r**ility *xists in t** *sNi*k p*r*m*t*r in ***tur*s*ripts prior to v*rsion ****.**

Reasoning

T** vuln*r**ility st*ms *rom un*s**p** us*r input in lo*in *rror m*ss***s. T** *ommit *i** s*ows t** vuln*r**ility w*s p*t**** *y ***in* `*tmlsp**i*l***rs()` *roun* t** $ni*k v*ri**l* in `*pp*ontroll*r::us*r*ut*`. T*is *un*tion **n*l*s *ut**nti**tion