PT-2022-17751 · Contao · Contao Managed Edition

Published 2022-03-18 · Updated 2023-08-08 · CVE-2022-26265

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Contao Managed Edition version 1.5.0

Description A remote command execution issue was discovered, allowing for potential exploitation via the php cli parameter. This could lead to unauthorized execution of commands.

Recommendations For Contao Managed Edition version 1.5.0, consider disabling the php cli parameter as a temporary workaround until a patch is available. Restrict access to the component utilizing the php cli parameter to minimize the risk of exploitation.

Exploit

Fix

RCE

OS Command Injection

Command Injection

Weakness Enumeration

CWE-78

CWE-77

Related Identifiers

CVE-2022-26265

GHSA-RGGC-4G3R-J7FF

Affected Products

Contao Managed Edition

References · 8

• 🔥 https://github.com/Inplex-sys/CVE-2022-26265 · Exploit
• 🔥❌ https://github.com/JCCD/Contao-Managed-Edition-1.5-RCE/blob/main/VulnerabilityDetails.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2022-26265 · Security Note
• https://osv.dev/vulnerability/GHSA-rggc-4g3r-j7ff · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-26265 · Vendor Advisory
• https://github.com/contao/managed-edition · Note
• https://t.me/cibsecurity/39283 · Telegram Post
• https://t.me/cybersecuritytechnologies/7308 · Telegram Post