PT-2022-22866 · Sourcecodester · Simple Cold Storage Management System

Thebugbountyhunter7 · Published 2022-10-17 · Updated 2023-12-28 · CVE-2022-3549

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SourceCodester Simple Cold Storage Management System version 1.0

Description A vulnerability was found in the Avatar Handler component, affecting the file /csms/admin/?page=user/manage user. This issue leads to unrestricted upload and can be initiated remotely. The manipulation affects some unknown processing of the file.

Recommendations For version 1.0, consider disabling the Avatar Handler component until a patch is available to prevent unrestricted upload. Restrict access to the /csms/admin/?page=user/manage user file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Unrestricted File Upload

Weakness Enumeration

CWE-266

CWE-434

Related Identifiers

CVE-2022-3549

Affected Products

Simple Cold Storage Management System

References · 6

• 🔥 https://github.com/Ramansh123454/POCs/blob/main/CSMS_RCE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3549 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3549 · Vendor Advisory
• https://vuldb.com/?id.211049 · Note
• https://t.me/cibsecurity/51573 · Telegram Post
• https://t.me/cvenotify/65459 · Telegram Post