CVE-2022-1033

creationtimestamp| type| source ---|---|--- 2022-03-23 11:28:25+00:00| seen| https://t.me/cibsecurity/39398...

CVE-2022-1033 Unrestricted Upload of File with Dangerous Type in crater-invoice/crater

Unrestricted Upload of File with Dangerous Type in GitHub repository crater-invoice/crater prior to 6.0.6...

CVE-2022-1033

CVE-2022-1033 affects crater-invoice/crater prior to 6.0.6 where there is no restriction on uploading dangerous file types. A PoC shows uploading a PHP webshell as an expense receipt, resulting in a stored file retrievable via attachment_receipt_url (e.g., /storage/50/2137webshell.php), enabling ...