PT-2022-26501 · Unknown · C-Data Web Management System

Ireading · Published 2022-12-01 · Updated 2023-06-27 · CVE-2022-4257

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions C-DATA Web Management System (affected versions not specified)

Description A critical issue affects the C-DATA Web Management System, specifically the file cgi-bin/jumpto.php of the component GET Parameter Handler. The manipulation of the hostname argument leads to argument injection. This issue can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Neutralization

OS Command Injection

Weakness Enumeration

CWE-707

CWE-78

Related Identifiers

CVE-2022-4257

Affected Products

C-Data Web Management System

References · 6

• 🔥 https://github.com/siriuswhiter/VulnHub/blob/main/C-Data/rce1.md · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4257 · Security Note
• https://vuldb.com/?id.214631 · Note
• https://t.me/cibsecurity/53768 · Telegram Post
• https://t.me/cvenotify/38882 · Telegram Post
• https://t.me/aptreports/2699 · Telegram Post