Lucene search

PRIOn knowledge basePRION:CVE-2022-37191

HistorySep 13, 2022 - 11:15 p.m.

Cross site request forgery (csrf)

2022-09-1323:15:00

PRIOn knowledge base

www.prio-n.com

cuppacms v1.0

cross-site request forgery

post request

lfi

component vulnerability

system files

6.3 Medium

AI Score

Confidence

High

0.252 Low

EPSS

Percentile

96.7%

JSON

The component “cuppa/api/index.php” of CuppaCMS v1.0 is Vulnerable to LFI. An authenticated user can read system files via crafted POST request using [function] parameter value as LFI payload.

CPENameOperatorVersion
cuppacmseq1.0

CPE	Name	Operator	Version
	cuppacms	eq	1.0

References

github.com/badru8612/CuppaCMS-Authenticated-LFI-Vulnerability

github.com/CuppaCMS/CuppaCMS/issues/20