PT-2022-19759 · Unknown · Wedding Management System

Published 2022-05-11 · Updated 2022-05-17 · CVE-2022-29655

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wedding Management System version 1.0

Description An arbitrary file upload vulnerability in the Upload Photos module allows attackers to execute arbitrary code via a crafted PHP file.

Recommendations For Wedding Management System version 1.0, consider disabling the Upload Photos module until a patch is available to prevent exploitation. Restrict access to the module to minimize the risk of arbitrary code execution. Avoid using the Upload Photos feature in the affected version until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-29655

Affected Products

Wedding Management System

References · 5

• 🔥 https://hackmd.io/HcH7QdEdRu67yfTJsKKFKA · Exploit
• https://osv.dev/vulnerability/CVE-2022-29655 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-29655 · Security Note
• https://t.me/cibsecurity/42346 · Telegram Post
• https://t.me/cvenotify/30352 · Telegram Post