PT-2022-16561 · Ritecms · Ritecms

Published 2022-04-12 · Updated 2022-04-20 · CVE-2022-24248

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:S/C:N/I:C/A:C

Name of the Vulnerable Software and Affected Versions RiteCMS versions 3.1.0 and below

Description The issue allows an authenticated attacker to delete any file in the web root, as well as other files on the server that the PHP process user has permissions to delete, via an arbitrary file deletion vulnerability using path traversal in the Admin Panel. This capability can be used to circumvent certain web server security mechanisms, such as deleting .htaccess files to deactivate security constraints.

Recommendations For RiteCMS versions 3.1.0 and below, update to a version above 3.1.0 to resolve the issue. As a temporary workaround, consider restricting access to the Admin Panel to minimize the risk of exploitation. Additionally, monitor server permissions and access controls to limit the potential damage from arbitrary file deletion.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-24248

Affected Products

Ritecms

References · 8

• 🔥 https://en.0day.today/exploit/description/37177 · Exploit
• 🔥 https://exploit-db.com/exploits/50615 · Exploit
• https://osv.dev/vulnerability/CVE-2022-24248 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24248 · Security Note
• https://t.me/cvenotify/29222 · Telegram Post
• https://t.me/cibsecurity/40612 · Telegram Post
• https://t.me/cvenotify/28762 · Telegram Post
• https://t.me/cvenotify/28750 · Telegram Post