PT-2022-20336 · Unknown · Wedding Management System

K0Xx11 · Published 2022-05-31 · Updated 2022-06-10 · CVE-2022-30821

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wedding Management System version 1.0

Description The issue concerns an arbitrary file upload vulnerability located in the picture upload point of the "package edit.php" file within the "Services" module of the background management system. This vulnerability is related to the editing function.

Recommendations For Wedding Management System version 1.0, consider disabling the file upload functionality in the "package edit.php" file until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to the "Services" module to minimize the risk of exploitation. Avoid using the picture upload point in the affected module until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-30821

Affected Products

Wedding Management System

References · 3

• 🔥 https://github.com/k0xx11/bug_report/blob/main/vendors/codeastro.com/wedding-management-system/RCE-2.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-30821 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30821 · Security Note