CVE-2022-30821

Exploit

EPSS 0.41%
Veröffentlicht 02.06.2022 14:15:55
Zuletzt bearbeitet 21.11.2024 07:03:27
Quelle cve@mitre.org
CVE-Watchlists
Login
Unerledigt
Login

In Wedding Management System v1.0, the editing function of the "Services" module in the background management system has an arbitrary file upload vulnerability in the picture upload point of "package_edit.php" file.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 4

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Wedding Management System Project ≫ Wedding Management System Version1.0

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.41%	0.605

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	8.8	2.8	5.9	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvd@nist.gov	6.5	8	6.4	AV:N/AC:L/Au:S/C:P/I:P/A:P

CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://github.com/k0xx11/bug_report/blob/main/vendors/codeastro.com/wedding-management-system/RCE-2.md

Third Party Advisory

Exploit

https://nvd.nist.gov/vuln/detail/CVE-2022-30821

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2022-30821

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2022-30821

EUVD