PT-2022-26550 · Unknown · House Rental System

Ace · Published 2022-12-03 · Updated 2022-12-06 · CVE-2022-4276

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions House Rental System (affected versions not specified)

Description A critical issue was found in the House Rental System, affecting some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the id photo argument leads to unrestricted upload. The attack can be launched remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Privilege Assignment

Unrestricted File Upload

Weakness Enumeration

CWE-266

CWE-434

Related Identifiers

CVE-2022-4276

Affected Products

House Rental System

References · 5

• 🔥 https://github.com/nikeshtiwari1/House-Rental-System/issues/8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-4276 · Security Note
• https://vuldb.com/?id.214772 · Note
• https://t.me/cvenotify/39222 · Telegram Post
• https://t.me/cibsecurity/53952 · Telegram Post