CVE-2022-42095: 
PHP vulnerability analysis and mitigation

Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Page content. The vulnerability was assigned CVE-2022-42095 and was discovered in September 2022 with the release of version 1.23.0 (Backdrop Release, CVE Details).

The vulnerability allows an attacker to execute stored XSS attacks through the Page content functionality. The attack vector requires the attacker to post content on the 'Page content' section and insert XSS payload in the 'Body' input field while using the Raw HTML Editor. The payload executes immediately after saving the content (GitHub POC).

The vulnerability allows attackers with admin privileges to inject and execute malicious JavaScript code that persists on the server and executes when other users view the affected page. This could lead to session hijacking, defacement, or other client-side attacks against users viewing the compromised page (GitHub POC).

The vulnerability was discovered in version 1.23.0 of Backdrop CMS. Users should ensure they are running the latest version of Backdrop CMS and restrict access to administrative functions to trusted users only (Backdrop CMS).

The vulnerability was discovered and reported by the Grim The Ripper Team from SOSECURE Thailand. The discovery was documented in a Medium post detailing the vulnerability and its exploitation (Medium Post).