CVE-2022-32409

2022-07-1421:24:22

mitre

www.cve.org

local file inclusion

portal do software publico brasileiro

arbitrary php code

crafted http request

cve-2022-32409

AI Score

9.6

Confidence

High

EPSS

0.473

Percentile

97.5%

JSON

A local file inclusion (LFI) vulnerability in the component codemirror.php of Portal do Software Publico Brasileiro i3geo v7.0.5 allows attackers to execute arbitrary PHP code via a crafted HTTP request.

References

github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt

owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion