PT-2022-21004 · Unknown · Chatbot App With Suggestion

Published 2022-06-01 · Updated 2022-06-10 · CVE-2022-31966

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChatBot App with Suggestion version 1.0

Description The issue allows deletion of any file via the /simple chat bot/classes/Master.php API endpoint with the f parameter set to delete img.

Recommendations For ChatBot App with Suggestion version 1.0, consider restricting access to the Master.php file or disabling the delete img function to prevent unauthorized file deletion until a fix is available. Avoid using the f parameter in the affected API endpoint /simple chat bot/classes/Master.php to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

CVE-2022-31966

Affected Products

Chatbot App With Suggestion

References · 4

• 🔥 https://github.com/k0xx11/bug_report/blob/main/vendors/oretnom23/chatbot-app-suggestion/delet-file-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-31966 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31966 · Security Note
• https://t.me/cibsecurity/43709 · Telegram Post