Vulnerability Description
NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Kalyan02 | Nanocms | 0.4 |
Related Weaknesses (CWE)
References
- https://github.com/ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploThird Party Advisory
- https://github.com/kalyan02/NanoCMSProduct
- https://www.exploit-db.com/exploits/50997Exploit
- https://www.vulncheck.com/advisories/nanocms-remote-code-execution-rce-authenticThird Party Advisory
- https://github.com/ishell/Exploits-Archives/blob/master/2009-exploits/0904-exploThird Party Advisory
FAQ
What is CVE-2022-50898?
CVE-2022-50898 is a vulnerability with a CVSS score of 8.8 (HIGH). NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary...
How severe is CVE-2022-50898?
CVE-2022-50898 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-50898?
Check the references section above for vendor advisories and patch information. Affected products include: Kalyan02 Nanocms.