Vulnerability Description
An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt
CVSS Score
9.1
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Taogogo | Taocms | 3.0.2 |
Related Weaknesses (CWE)
References
- https://github.com/chasingboy/cms-pentest/blob/main/taocms-arbitrary-file-deletiExploitThird Party Advisory
- https://github.com/chasingboy/cms-pentest/blob/main/taocms-arbitrary-file-deleti
- https://github.com/chasingboy/cms-pentest/blob/main/taocms-arbitrary-file-deletiExploitThird Party Advisory
- https://github.com/chasingboy/cms-pentest/blob/main/taocms-arbitrary-file-deleti
FAQ
What is CVE-2022-36261?
CVE-2022-36261 is a vulnerability with a CVSS score of 9.1 (CRITICAL). An arbitrary file deletion vulnerability was discovered in taocms 3.0.2, that allows attacker to delete file in server when request url admin.php?action=file&ctrl=del&path=/../../../test.txt
How severe is CVE-2022-36261?
CVE-2022-36261 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2022-36261?
Check the references section above for vendor advisories and patch information. Affected products include: Taogogo Taocms.