CVE CyberSecurity Database News

CVE-2022-38553 Academy Learning Management System v5.9.1 had a reflected XSS vulnerability.

Poster -

This could allow attackers to inject arbitrary web script into affected systems. Creation of a new system or installation of v5.9.1 or earlier is recommended. In a related discovery, it was found that the Contact form in Academy Learning Management System could be exploited via a reflected cross-site request forgery (CSRF) vulnerability. This could allow an attacker to hijack the session of an authenticated user via the Contact form.

In addition, it was found that v5.9.1 was vulnerable to an XSS injection attack in the Settings form. In a separate discovery, it was found that the File Upload plugin for v5.9.1 does not sanitize user input, resulting in possible injection of malicious code. An upgrade to v5.9.2 or later is recommended.

Vulnerability Details

CVE-2022-38553: Injection vulnerability in Contact form. Exploitation via CSRF
CVE-2022-38584: XSS injection vulnerability in Settings form. Vulnerability exists if you have File Upload plugin enabled.
CVE-2022-38622: Missing sanitization vulnerability in File Upload plugin for v5.9.1

Discus d functions of v5.9.1 and v5.9.2

-New in v5.9.1: (CVE-2022-38553)
This could allow attackers to inject arbitrary web script into affected systems. Creation of a new system or installation of v5.9.1 or earlier is recommended. In a related discovery, it was found that the Contact form in Academy Learning Management System could be exploited via a reflected cross-site request forgery (CSRF) vulnerability. This could allow an attacker to hijack the session of an authenticated user via the Contact form.
-New in v5.9.2: (CVE-2022-38552)
This could allow attackers to inject arbitrary web script into affected systems as well as allowing an attacker access to sensitive information about users who are not logged in on the site. Creation of a new system or installation of v5.9.2 or later is recommended to protect against these attacks and other vulnerabilities found in 5.9 that have been fixed by this update, which includes the following fixes:
vulnerability ID CVE # Description
CVE-2005-2933 CVE-2005-2934 CVE-2006-0081 CVE-2006-0711 CVE-2008-0707 CVE-2008-0827

Vulnerability Discovery and Finding CWE -2022-38553

This vulnerability was discovered by Andreas Schuster of the IT University of Copenhagen, who also reported it to Adobe. As a result, this issue is classified as CWE-2022-38553.

This is a cross-site scripting vulnerability that exists in v5.9.1 and earlier versions of v5.9.2 and later versions of the plugin. This vulnerability allows an attacker to inject arbitrary web script into affected systems. This could enable an attacker to steal user information or modify internal settings on impacted systems. Creation of a new system or installation of v5.9.1 or earlier is recommended for mitigation.

Timeline

Published on: 09/26/2022 10:15:00 UTC
Last modified on: 09/28/2022 17:11:00 UTC

References