PT-2022-18197 · Unknown · Ecjia-Daojia

Spiderlronman · Published 2022-04-19 · Updated 2024-08-03 · CVE-2022-27055

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions ecjia-daojia version 1.38.1-20210202629

Description The issue concerns information leakage via the content/apps/installer/classes/Helper.php file. When the web program is installed, a new environment file is created, recording database information, including the database record password. The vendor disputes this vulnerability, stating that the environment file is in the data directory, which is not intended for access by website visitors, as only the statics directory can be accessed by them.

Recommendations For version 1.38.1-20210202629, consider restricting access to the content/apps/installer/classes/Helper.php file to minimize the risk of information leakage. Additionally, ensure that the data directory is properly secured to prevent unauthorized access. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-27055

Affected Products

Ecjia-Daojia

References · 8

• 🔥 https://github.com/ecjia/ecjia-daojia/blob/dfb322387e8d3d50719e44d23d793072616ff789/content/apps/installer/classes/Controllers/IndexController.php#L74-L78 · Exploit
• 🔥 https://github.com/ecjia/ecjia-daojia/blob/dfb322387e8d3d50719e44d23d793072616ff789/content/apps/installer/classes/Helper.php#L312-L318 · Exploit
• https://osv.dev/vulnerability/CVE-2022-27055 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27055 · Security Note
• https://github.com/ecjia/ecjia-daojia/issues/20 · Note
• https://t.me/cvenotify/88707 · Telegram Post
• https://t.me/cvenotify/29431 · Telegram Post
• https://t.me/cibsecurity/41104 · Telegram Post