PT-2023-14700 · Schlix Web · Schlix Cms

Francisco Marinho · Publicado 2023-02-07 · Atualizado 2024-08-03 · CVE-2022-45544

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schlix Web Inc SCHLIX CMS version 2.2.7-2

Description The issue allows an attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. However, it is noted that this functionality is intentionally allowed for admins to upload new executable PHP code from trusted sources. The vulnerability is disputed by the vendor as it requires admin privileges to upload such code.

Recommendations For version 2.2.7-2, consider restricting access to the tristao parameter to prevent unauthorized file uploads and code execution. As a temporary workaround, restrict the ability to upload new executable PHP code to only trusted sources and ensure that all admins are aware of the potential risks associated with this functionality.

Exploit

Correção

Incorrect Authorization

Enumeração de Fraquezas

CWE-863

Identificadores relacionados

CVE-2022-45544

Produtos afetados

Schlix Cms

Referências · 12

• 🔥 https://github.com/tristao-marinho/CVE-2022-45544/blob/main/README.md · Exploit
• https://t.me/cvenotify/88796 · Publicação no Telegram
• https://t.me/cvenotify/86342 · Publicação no Telegram
• https://t.me/cvenotify/45037 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2022-45544 · Aviso do Fabricante
• https://t.me/cvenotify/44373 · Publicação no Telegram
• https://t.me/cvenotify/43783 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2022-45544 · Nota de Segurança
• https://schlix.com · Nota
• https://schlix.com/downloads/schlix-cms/schlix-cms-v2.2.7-2.zip · Nota
• https://t.me/cibsecurity/57667 · Publicação no Telegram
• https://blog.tristaomarinho.com/schlix-cms-2-2-7-2-arbitrary-file-upload · Nota