CVE-2022-1952
eaSYNC < 1.1.16 - Unauthenticated Arbitrary File Upload
Vexday Risk Score
23Baixo
Decisão SSVC (CISA)
Attend
PoC disponível → acompanhar de perto
CVSS —EPSS 17.6%KEV nãoPoC —Nuclei simMetasploit —Patch —
Ciclo de vida
11 jul 2022Publicada no NVD
Recomendação: Planejar correção próxima — já existe PoC pública.
The Free Booking Plugin for Hotels, Restaurant and Car Rental WordPress plugin before 1.1.16 suffers from insufficient input validation which leads to arbitrary file upload and subsequently to remote code execution. An AJAX action accessible to unauthenticated users is affected by this issue. An allowlist of valid file extensions is defined but is not used during the validation steps.
Quer saber se a sua infraestrutura está exposta a isto?
Falar com a TrueHacking →