CVE-2022-40797

CVSS 9.8 CRITICALEPSS 2.6%CWE-434

Vexday Risk Score

48Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 9.8EPSS 2.6%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

09 Nov 2022Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4, and .php5 files. (Visiting any .phar file invokes the PHP interpreter in some realistic web-server configurations.)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

public PoCs found — 1

cve_referencepacketstormsecurity.com/files/169964/Roxy-Fileman-1.4.6-Remote-Shell-Upload.htmlunverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/169964/Roxy-Fileman-1.4.6-Remote-Shell-Upload.html https://gist.github.com/Hadi999/1f66fe7c5a217ca261ebfec36c630d18 https://salsa.debian.org/php-team/php/-/blob/dc253886b5b2e9bc8d9e36db787abb083a667fd8/debian/php-cgi.conf#L5-6 https://web.archive.org/web/20210126213412/https://roxyfileman.com/download.php?f=1.4.6-php