CVE-2022-31126

🗓️ 06 Jul 2022 17:30:13Reported by GitHub_MType

cve🔗 web.nvd.nist.gov📰️ 5 Media mentions👁 99 Views🌐 WEB

Roxy-wi allows remote code execution via HTTP request in /app/options.py (CVE-2022-31126)

Reporter	Title	Published	Views	Family All 13
0day.today	Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution Vulnerability	3 Apr 202300:00	–	zdt
Circl	CVE-2022-31126	6 Jul 202222:14	–	circl
CNNVD	Roxy-WI 注入漏洞	6 Jul 202200:00	–	cnnvd
Cvelist	CVE-2022-31126 Unauthenticated Remote Code Execution in Roxy-wi	6 Jul 202217:30	–	cvelist
Exploit DB	Roxy WI v6.1.0.0 - Unauthenticated Remote Code Execution (RCE)	3 Apr 202300:00	–	exploitdb
Nuclei	Roxy-WI - Remote Code Execution	6 Jun 202603:01	–	nuclei
NVD	CVE-2022-31126	6 Jul 202218:15	–	nvd
OSV	CVE-2022-31126 Unauthenticated Remote Code Execution in Roxy-wi	6 Jul 202217:30	–	osv
Packet Storm	Roxy WI 6.1.0.0 Remote Code Execution	3 Apr 202300:00	–	packetstorm
Prion	Design/Logic Flaw	6 Jul 202218:15	–	prion

NVD

Vulners

Node

roxy-wi roxy-wiRange<6.1.1.0

[
  {
    "product": "roxy-wi",
    "vendor": "hap-wi",
    "versions": [
      {
        "status": "affected",
        "version": "< 6.1.1.0"
      }
    ]
  }
]

Source	Link
github	www.github.com/hap-wi/roxy-wi/security/advisories/GHSA-mh86-878h-43c9

Parameter	Position	Path	Description	CWE
show_versions	request body	/app/options.py	Unauthenticated remote code execution via crafted POST to /app/options.py	CWE-74
token	request body	/app/options.py	Unauthenticated remote code execution via crafted POST to /app/options.py	CWE-74
alert_consumer	request body	/app/options.py	Unauthenticated remote code execution via crafted POST to /app/options.py	CWE-74
serv	request body	/app/options.py	Unauthenticated remote code execution via crafted POST to /app/options.py	CWE-74
getcert	request body	/app/options.py	Unauthenticated remote code execution via crafted POST to /app/options.py	CWE-74
id	request body	/app/options.py	Unauthenticated remote code execution via crafted POST to /app/options.py	CWE-74