CVE-2026-45228 — Cross-Site Scripting (XSS)

title: CVE-2026-45228 - Quark Drive Stored XSS via System Configuration POST
id: scw-2026-05-13-ai-1
status: experimental
level: high
description: |
  Detects the specific POST request to the /update endpoint with 'push_config' in the URI query, containing potential XSS payloads like '<script>' in the query parameters. This targets the stored XSS vulnerability in Quark Drive's System Configuration page (CVE-2026-45228) where unescaped key names are rendered using v-html.
author: SCW Feed Engine (AI-generated)
date: 2026-05-13
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-45228/
tags:
  - attack.initial_access
  - attack.t1190
logsource:
    category: webserver
detection:
  selection:
      cs-uri|contains:
          - '/update'
      cs-method|exact:
          - 'POST'
      cs-uri-query|contains:
          - 'push_config'
  selection_indicators:
      cs-uri-query|contains:
          - '<script>'
      condition: selection AND selection_indicators
  
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse