CVE-2022-31300

Deeper analysis

CVE-2022-31300 is a stored cross-site scripting flaw (CWE-79) residing in the DM Section component of Haraj version 3.7. The vulnerability permits an attacker to supply a crafted POST request that injects arbitrary JavaScript or HTML, which is subsequently rendered for other users who view the affected section. The issue carries a CVSS 3.1 base score of 5.4, reflecting network attack vector, low attack complexity, low privileges required, and a requirement for user interaction with changed scope.

An authenticated user holding low-privileged credentials can exploit the flaw by submitting malicious content that executes in the browser context of higher-privileged or other ordinary users, enabling theft of session tokens, defacement, or redirection to attacker-controlled sites. Public references include a proof-of-concept repository demonstrating the POST-based injection against the listed product version.

No vendor advisory or patch information appears among the supplied references, and the EPSS score has remained flat at 0.0752 with no observable increase after disclosure.