PT-2022-26041 · Badaso · Badaso

Retr02332

·

CVE-2022-41711

·

Published

2022-10-25

·

Updated

2022-10-28

CVSS v3.1

9.8

Critical

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Badaso version 2.6.0
Description The issue allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Recommendations For Badaso version 2.6.0, update to a version that properly validates user-uploaded data to prevent arbitrary code execution. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2022-41711
GHSA-FWVC-9XHJ-26V5

Affected Products

Badaso