PT-2023-14700 · Schlix Web · Schlix Cms

Francisco Marinho · CVE-2022-45544 · Published 2023-02-07 · Updated 2024-08-03

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Schlix Web Inc SCHLIX CMS version 2.2.7-2

Description The issue allows an attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. However, it is noted that this functionality is intentionally allowed for admins to upload new executable PHP code from trusted sources. The vulnerability is disputed by the vendor as it requires admin privileges to upload such code.

Recommendations For version 2.2.7-2, consider restricting access to the tristao parameter to prevent unauthorized file uploads and code execution. As a temporary workaround, restrict the ability to upload new executable PHP code to only trusted sources and ensure that all admins are aware of the potential risks associated with this functionality.

Exploit

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2022-45544

Affected Products

Schlix Cms

References · 12

• 🔥 https://github.com/tristao-marinho/CVE-2022-45544/blob/main/README.md · Exploit
• https://osv.dev/vulnerability/CVE-2022-45544 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-45544 · Security Note
• https://t.me/cvenotify/88796 · Telegram Post
• https://t.me/cvenotify/86342 · Telegram Post
• https://t.me/cvenotify/45037 · Telegram Post
• https://t.me/cvenotify/44373 · Telegram Post
• https://t.me/cvenotify/43783 · Telegram Post
• https://schlix.com · Note
• https://schlix.com/downloads/schlix-cms/schlix-cms-v2.2.7-2.zip · Note
• https://t.me/cibsecurity/57667 · Telegram Post
• https://blog.tristaomarinho.com/schlix-cms-2-2-7-2-arbitrary-file-upload · Note