PT-2022-26317 · Unknown · Wedding Planner

Tr0Ee · Published 2022-10-11 · Updated 2025-05-19 · CVE-2022-42229

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wedding Planner version 1.0

Description The issue allows for arbitrary code execution via the "package edit.php" endpoint.

Recommendations For version 1.0, update to a version that fixes this issue, if available, or consider disabling access to the "package edit.php" endpoint as a temporary workaround to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-42229

Affected Products

Wedding Planner

References · 4

• 🔥 https://github.com/Tr0ee/bug_report/blob/main/vendors/pushpam02/wedding-planner/RCE-1.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-42229 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-42229 · Security Note
• https://t.me/cvenotify/123013 · Telegram Post