PT-2022-19565 · Phpok · Phpok

Wa1Ki0G · Published 2022-05-12 · Updated 2022-05-23 · CVE-2022-29363

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Phpok version 6.1

Description The issue is related to a deserialization vulnerability via the update f() function in login control.php. This allows attackers to write arbitrary files, potentially leading to getting shell access.

Recommendations For Phpok version 6.1, consider disabling the update f() function in login control.php as a temporary workaround until a patch is available. Restrict access to the login control.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

CVE-2022-29363

Affected Products

Phpok

References · 4

• 🔥 https://github.com/qinggan/phpok/issues/12 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-29363 · Security Note
• https://osv.dev/vulnerability/CVE-2022-29363 · Vendor Advisory
• https://t.me/cibsecurity/42535 · Telegram Post