PT-2022-17380 · Taocms · Taocms

K0Xx11 · CVE-2022-25578 · Published 2022-03-18 · Updated 2024-02-14

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions taocms version 3.0.2

Description The issue allows attackers to execute code injection via arbitrarily editing the .htaccess file.

Recommendations For taocms version 3.0.2, restrict access to the .htaccess file to prevent arbitrary edits and potential code injection attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-25578

Affected Products

Taocms

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/25xxx/CVE-2022-25578.json · Exploit
• 🔥 https://github.com/taogogo/taocms/issues/28 · Exploit
• https://osv.dev/vulnerability/CVE-2022-25578 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-25578 · Security Note
• https://t.me/cibsecurity/39287 · Telegram Post
• http://taocms.com · Note