PT-2022-25573 · Ndk Design · Ndkadvancedcustomizationfields

Dalii · Published 2022-11-22 · Updated 2024-02-14 · CVE-2022-40842

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ndk design NdkAdvancedCustomizationFields version 3.5.0

Description The issue is related to Server-side request forgery (SSRF) via the rotateimg.php file. This allows for potential unauthorized access to internal resources.

Recommendations For ndk design NdkAdvancedCustomizationFields version 3.5.0, consider restricting access to the rotateimg.php file as a temporary workaround until a patch is available.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2022-40842

Affected Products

Ndkadvancedcustomizationfields

References · 6

• 🔥 https://github.com/daaaalllii/cve-s/blob/main/CVE-2022-40842/poc.txt · Exploit
• https://osv.dev/vulnerability/CVE-2022-40842 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-40842 · Security Note
• https://t.me/cvenotify/38315 · Telegram Post
• http://ndkadvancedcustomizationfields.com · Note
• https://t.me/cibsecurity/53308 · Telegram Post