PT-2022-25623 · Unknown · Zoo Management System

Tmoontadmind · Published 2022-09-26 · Updated 2023-11-14 · CVE-2022-40925

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zoo Management System version 1.0

Description The issue is related to an arbitrary file upload vulnerability in the picture upload point of the "save event" file of the "Events" module in the background management system. This vulnerability is present in the "save event" file, which is part of the "Events" module.

Recommendations For Zoo Management System version 1.0, consider disabling the picture upload functionality in the "save event" file of the "Events" module until a patch is available. Restrict access to the "save event" file to minimize the risk of exploitation. Avoid using the picture upload point in the "Events" module until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-40925

Affected Products

Zoo Management System

References · 6

• 🔥 https://github.com/admin77888/Bug_report/blob/main/vendors/pushpam02/zoo-management-system/RCE-2.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-40925 · Security Note
• https://osv.dev/vulnerability/CVE-2022-40925 · Vendor Advisory
• https://t.me/cvenotify/36921 · Telegram Post
• https://t.me/cibsecurity/50475 · Telegram Post
• https://t.me/cvenotify/36819 · Telegram Post