Vulners
Lucene search
Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
| Reporter | Title | Published | Views | Family All 17 |
|---|---|---|---|---|
 | Microweber 1.2.11 - Remote Code Execution (Authenticated) Vulnerability | 21 Feb 202200:00 | – | zdt |
 | OS Command Injection in microweber/microweber | 5 Feb 202215:03 | – | huntr |
 | CVE-2022-0557 | 11 Feb 202209:15 | – | attackerkb |
 | CVE-2022-0557 | 11 Feb 202212:28 | – | circl |
 | Microweber 操作系统命令注入漏洞 | 11 Feb 202200:00 | – | cnnvd |
 | Microweber command injection vulnerability | 15 Feb 202200:00 | – | cnvd |
 | Packagist Microweber Arbitrary File Upload (CVE-2022-0557) | 27 Nov 202200:00 | – | checkpoint_advisories |
 | CVE-2022-0557 | 11 Feb 202208:45 | – | cve |
 | CVE-2022-0557 OS Command Injection in microweber/microweber | 11 Feb 202208:45 | – | cvelist |
 | OS Command Injection in Microweber | 12 Feb 202200:00 | – | github |
10
# Exploit Title: Microweber 1.2.11 - Remote Code Execution (RCE) (Authenticated)
# Google Dork: NA
# Date: 02/17/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://microweber.org/
# Software Link: https://github.com/microweber/microweber
# Version: 1.2.11
# Tested on: [KALI OS]
# CVE : CVE-2022-0557
# Reference : https://huntr.dev/bounties/660c89af-2de5-41bc-aada-9e4e78142db8/
# Step To Reproduce
- Login using Admin Creds.
- Navigate to User Section then Add/Modify Users
- Change/Add image of profile and Select a Crafted Image file
- Crafted image file Aka A image file which craft with PHP CODES for execution
- File Extension of Crafted File is PHP7 like "Sample.php7"
- Path of Uploaded Crafted SHELL https://localhost/userfiles/media/default/shell.php7Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
21 Feb 2022 00:00Current
7High risk
Vulners AI Score7
CVSS 3.17.2
CVSS 29
CVSS 38.1
EPSS0.1686