.. / CVE-2022-29005

Exploit for Online Birth Certificate System 1.2 - Stored Cross-Site Scripting (CVE-2022-29005)

Description:

Online Birth Certificate System 1.2 contains multiple stored cross-site scripting vulnerabilities in the component /obcs/user/profile.php, which allows an attacker to execute arbitrary web script or HTML via a crafted payload injected into the fname or lname parameters.

Nuclei Template

View the template here CVE-2022-29005.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-29005.yaml
Copy

References:

https://phpgurukul.com/online-birth-certificate-system-using-php-and-mysql/
https://github.com/sudoninja-noob/CVE-2022-29005/blob/main/CVE-2022-29005.txt
https://github.com/ARPSyndicate/kenzer-templates
http://online.com
https://nvd.nist.gov/vuln/detail/CVE-2022-29005