PT-2023-15701 · Unknown · Sunlogin Sunflower Simplified

Daffainfose · Published 2023-02-13 · Updated 2025-10-18 · CVE-2022-48323

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) version 1.0.1.43315

Description Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) version 1.0.1.43315 is susceptible to a path traversal issue. A remote, unauthenticated attacker can execute arbitrary programs on a victim host by sending a specially crafted HTTP request. The attack involves using the /check API endpoint with the cmd parameter set to ping../ followed by the path to a program, such as powershell.exe. This allows for traversal outside the intended directory and execution of commands on the system.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-48323

Affected Products

Sunlogin Sunflower Simplified

References · 9

• 🔥 https://github.com/projectdiscovery/nuclei-templates/blob/8500efb7c5c52261229bb87b3af8a6e4e5afc877/cnvd/2022/CNVD-2022-03672.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-48323 · Security Note
• https://osv.dev/vulnerability/CVE-2022-48323 · Vendor Advisory
• https://t.me/cibsecurity/57987 · Telegram Post
• https://asec.ahnlab.com/en/47088 · Note
• https://t.me/cvenotify/44919 · Telegram Post
• https://t.me/cvenotify/115659 · Telegram Post
• https://cnvd.org.cn/flaw/show/CNVD-2022-03672 · Note
• https://twitter.com/pdnuclei_bot/status/1979623549045252360 · Twitter Post