PT-2022-17265 · Hms · Hms

Published 2022-02-23 · Updated 2023-08-08 · CVE-2022-25402

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions HMS version 1.0

Description An issue with access control in HMS allows unauthenticated attackers to read and modify all PHP files.

Recommendations For HMS version 1.0, consider restricting access to PHP files until a fix is available. As a temporary workaround, review and secure access controls to prevent unauthorized modifications.

Exploit

Fix

Related Identifiers

CVE-2022-25402

Affected Products

Hms

References · 4

• 🔥❌ https://github.com/dota-st/Vulnerability/blob/master/HMS/HMS.md · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2022-25402 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25402 · Security Note
• https://t.me/cvenotify/27697 · Telegram Post