PT-2023-15701 · Unknown · Sunlogin Sunflower Simplified

Daffainfose · Publicado 2023-02-13 · Atualizado 2025-10-18 · CVE-2022-48323

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) version 1.0.1.43315

Description Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) version 1.0.1.43315 is susceptible to a path traversal issue. A remote, unauthenticated attacker can execute arbitrary programs on a victim host by sending a specially crafted HTTP request. The attack involves using the /check API endpoint with the cmd parameter set to ping../ followed by the path to a program, such as powershell.exe. This allows for traversal outside the intended directory and execution of commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2022-48323

Produtos afetados

Sunlogin Sunflower Simplified

Referências · 9

• 🔥 https://github.com/projectdiscovery/nuclei-templates/blob/8500efb7c5c52261229bb87b3af8a6e4e5afc877/cnvd/2022/CNVD-2022-03672.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-48323 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2022-48323 · Aviso do Fabricante
• https://t.me/cibsecurity/57987 · Publicação no Telegram
• https://asec.ahnlab.com/en/47088 · Nota
• https://t.me/cvenotify/44919 · Publicação no Telegram
• https://t.me/cvenotify/115659 · Publicação no Telegram
• https://cnvd.org.cn/flaw/show/CNVD-2022-03672 · Nota
• https://twitter.com/pdnuclei_bot/status/1979623549045252360 · Publicação no Twitter