by Kastro
Paper/Archive/CVE-2022-4136

CVE-2022-4136

qmpaas qmpaas/leadshop — Exposed Dangerous Method or Function in qmpaas/leadshop

EPSS 1%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.4.634 × 2012.7Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Dangerous method exposed which can lead to RCE in qmpass/leadshop v1.4.15 allows an attacker to control the target host by calling any function in leadshop.php via the GET method.

Affected

ProductAffectedFixed inSource
qmpaas/leadshopunspecified – < 1.4.161.4.16CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
@huntrdev (CNA)8.6CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refhuntr.dev/bounties/fe418ae1-7c80-4d91-8a5a-923d60ba78c3refgithub.com/qmpaas/leadshop/commit/f27e9ca5c93eaadda1097396b65c234b16186d67