PT-2022-26519 · Unknown · Feminer Wms

Ace · Published 2022-12-03 · Updated 2023-04-26 · CVE-2022-4272

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions FeMiner wms (affected versions not specified)

Description A critical issue has been found in FeMiner wms, affecting some unknown functionality of the file "/product/savenewproduct.php?flag=1". The manipulation of the upfile argument leads to unrestricted upload. The attack can be launched remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to the "/product/savenewproduct.php?flag=1" endpoint to minimize the risk of exploitation. Avoid using the upfile argument in the affected endpoint until the issue is resolved.

Exploit

Incorrect Privilege Assignment

Unrestricted File Upload

Weakness Enumeration

CWE-266

CWE-434

Related Identifiers

CVE-2022-4272

Affected Products

Feminer Wms

References · 6

• 🔥 https://github.com/FeMiner/wms/issues/14 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4272 · Security Note
• https://t.me/cibsecurity/53947 · Telegram Post
• http://openwall.com/lists/oss-security/2023/04/26/1 · Note
• https://vuldb.com/?id.214760 · Note
• https://t.me/cvenotify/39047 · Telegram Post