PT-2022-16560 · Ritecms · Ritecms

Faisalfs10X · Published 2022-04-12 · Updated 2022-04-19 · CVE-2022-24247

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions RiteCMS versions 3.1.0 and below

Description The issue allows an authenticated attacker to overwrite any file in the web root, as well as any other file on the server that the PHP process user has the proper permissions to write, resulting in remote code execution. This is due to an arbitrary file overwrite via path traversal vulnerability in the Admin Panel.

Recommendations For versions 3.1.0 and below, update to a version above 3.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the Admin Panel to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-24247

Affected Products

Ritecms

References · 7

• 🔥 https://exploit-db.com/exploits/50614 · Exploit
• 🔥 https://cxsecurity.com/issue/WLB-2022010019 · Exploit
• https://osv.dev/vulnerability/CVE-2022-24247 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24247 · Security Note
• https://t.me/cvenotify/28763 · Telegram Post
• https://t.me/cvenotify/28751 · Telegram Post
• https://t.me/cibsecurity/40608 · Telegram Post