Lucene search
WPScanCVELIST:CVE-2022-0656HistoryApr 25, 2022 - 3:51 p.m.
CVE-2022-0656 uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
2022-04-2515:51:03
CWE-552
WPScan
www.cve.org
2
web to print
wordpress plugin
unauthenticated access
EPSS
0.007
Percentile
79.6%
The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udraw_convert_url_to_base64 AJAX action (available to both unauthenticated and authenticated users) before using it in the file_get_contents function and returning its content base64 encoded in the response. As a result, unauthenticated users could read arbitrary files on the web server (such as /etc/passwd, wp-config.php etc)
CNA Affected
[
{
"product": "Web To Print Shop : uDraw",
"vendor": "Unknown",
"versions": [
{
"lessThan": "3.3.3",
"status": "affected",
"version": "3.3.3",
"versionType": "custom"
}
]
}
]Related
cnvd
cnvd
patchstack
patchstack
nuclei
nuclei
uDraw <3.3.3 - Local File Inclusion
2022-07-11 17:43:37
wpexploit
wpexploit
uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
2022-03-29 00:00:00
wpvulndb
wpvulndb
uDraw < 3.3.3 - Unauthenticated Arbitrary File Access
2022-03-29 00:00:00
cve
cve
CVE-2022-0656
2022-04-25 16:16:07
nvd
nvd
CVE-2022-0656
2022-04-25 16:16:07
prion
prion
Code injection
2022-04-25 16:16:00