CVE-2022-31298

Deeper analysis

CVE-2022-31298 is a stored cross-site scripting flaw (CWE-79) affecting the ads comment section of Haraj version 3.7. An authenticated user can supply a crafted POST request that stores attacker-controlled HTML or JavaScript in the comment field; the payload is later rendered without sanitization for other users who view the advertisement.

An attacker with a low-privileged account on the Haraj instance can therefore achieve script execution in the context of any victim who loads the affected page. The CVSS 5.4 vector reflects network attack reach, low attack complexity, required user interaction, and changed scope, resulting in limited confidentiality and integrity impact without availability loss.

Public references consist of the vendor product pages and a GitHub repository containing proof-of-concept code; no vendor advisory or patch information is present in the supplied references. The EPSS score has remained flat at 0.0752 with no material increase after disclosure.