PT-2022-19739 · Unknown · Roncoo Education

Binganaoo · Published 2022-05-26 · Updated 2022-06-08 · CVE-2022-29632

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Roncoo Education version 9.0.0

Description The issue is related to an arbitrary file upload vulnerability in the /course/api/upload/pic component, allowing attackers to execute arbitrary code via a crafted file.

Recommendations For Roncoo Education version 9.0.0, consider disabling the /course/api/upload/pic component until a patch is available to prevent arbitrary file uploads and subsequent code execution. Restrict access to this component to minimize the risk of exploitation. Avoid using this component for file uploads until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-29632

Affected Products

Roncoo Education

References · 6

• 🔥 https://github.com/roncoo/roncoo-education/issues/16 · Exploit
• https://osv.dev/vulnerability/CVE-2022-29632 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29632 · Security Note
• https://t.me/cibsecurity/43456 · Telegram Post
• https://t.me/cvenotify/30803 · Telegram Post
• https://t.me/cvenotify/30821 · Telegram Post