by Kastro
Paper/Archive/CVE-2022-51022

CVE-2022-51022

liukuo362573 YiShaAdmin — YiShaAdmin 3.1 Unauthenticated Path Traversal via DownloadFile endpoint

EPSS 0.8%CVSS 9.1
critical.is priorityof 100
39
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 56.3.563 × 2011.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.

Affected

ProductAffectedFixed inSource
YiShaAdmin2.2 – 3.1–CNA

Scores by source

VulnCheck (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
VulnCheck (CNA)8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

References

exploithuntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128patchgithub.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151efpatchgithub.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931dwriteupgithub.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/yishaadmin-lfi.yamlwriteupvulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-downloadfile-endpoint