PT-2022-23536 · Unknown · Garage Management System

Mass Technolog… + 1 · Published 2022-09-14 · Updated 2022-09-16 · CVE-2022-36667

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Garage Management System version 1.0

Description The issue is related to a lack of filtering in the file upload function, allowing an attacker to upload a PHP Reverse Shell and gain Remote Code Execution (RCE) during the process of adding parts.

Recommendations For Garage Management System version 1.0, consider disabling the file upload function until a patch is available to prevent exploitation. Restrict access to the upload functionality to minimize the risk of RCE attacks. Avoid using the file upload feature in the parts addition process until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-36667

Affected Products

Garage Management System

References · 6

• 🔥 https://github.com/saitamang/POC-DUMP/blob/main/Garage%20Management%20System/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-36667 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-36667 · Security Note
• https://t.me/cvenotify/36282 · Telegram Post
• https://t.me/cibsecurity/49756 · Telegram Post
• https://sourcecodester.com/php/15485/garage-management-system-using-phpmysql-source-code.html · Note