ozozuz/qlik-view-12.60-including-sr-stored-cross-site-scripting-cve-2022-42248Proof-of-concept exploit for CVE-2022-42248, a stored cross-site scripting vulnerability in QlikView Ajax Client allowing remote attackers to execute arbitrary web scripts via crafted HTTP POST requests.
Revision: 1.0
Impact: Stored cross-site scripting in QlikView Ajax Client allows a remote attacker to execute arbitrary web scripts or HTML in a victim's browser by bypassing the allowed-protocol limitation during interactive object creation.
Severity:
CVSS Score:
CVE-ID: CVE-2022-42248
Vendor: Qlik
Affected Products:
Affected Versions: 12.60 and earlier, including SR builds
QlikView is a business intelligence and data visualization platform used to explore and present interactive dashboards and analytical content.
In QlikView Ajax Client, the validation applied to allowed protocols during interactive object creation can be bypassed with a specially crafted HTTP POST request. This allows an attacker to store malicious web content that is later rendered back to the user.
Because the payload is stored and then served through the application flow, the browser executes the injected script or HTML in the context of the trusted QlikView origin.
Send a crafted HTTP POST request that injects a payload into an interactive object creation flow.
Example payload:
<svg xmlns="http://www.w3.org/2000/svg" onload="alert(document.domain)"></svg>
The malicious content is accepted and later executed when the affected object is rendered in the QlikView Ajax Client.
Refer to QlikView Release Notes May 2022 SR2 and upgrade to 12.70 SR2 or above.
This vulnerability was discovered and reported by:
Copyright (c) 2025 Giulio Garzia "Ozozuz"