PT-2022-25826 · Unknown · Qmpass/Leadshop

Published 2022-11-24 · Updated 2022-11-30 · CVE-2022-4136

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions qmpass/leadshop version 1.4.15

Description The issue allows an attacker to control the target host by calling any function in leadshop.php via the GET method, potentially leading to remote code execution (RCE). This can enable an attacker to access, download, create, or delete files on the server, making it possible to download a PHP Trojan or disrupt normal services. More than ten IPs are reportedly using this service.

Recommendations For qmpass/leadshop version 1.4.15, consider restricting access to the leadshop.php file to minimize the risk of exploitation until a patch is available. As a temporary workaround, disabling the ability to call functions via the GET method in leadshop.php can help mitigate the issue.

Exploit

Fix

Weakness Enumeration

CWE-749

Related Identifiers

CVE-2022-4136

Affected Products

Qmpass/Leadshop

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/4xxx/CVE-2022-4136.json · Exploit
• 🔥 https://huntr.dev/bounties/fe418ae1-7c80-4d91-8a5a-923d60ba78c3 · Exploit
• https://github.com/qmpaas/leadshop/commit/f27e9ca5c93eaadda1097396b65c234b16186d67 · Patch
• https://osv.dev/vulnerability/CVE-2022-4136 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4136 · Security Note
• https://t.me/cibsecurity/53475 · Telegram Post
• https://t.me/cvenotify/38804 · Telegram Post
• https://t.me/cvenotify/38412 · Telegram Post