Vulnerability Description
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/MegaTKC/AeroCMS
- https://www.exploit-db.com/exploits/51085
- https://www.vulncheck.com/advisories/aero-cms-php-code-injection-via-posts-php
FAQ
What is CVE-2022-50944?
CVE-2022-50944 is a vulnerability with a CVSS score of 8.8 (HIGH). Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upl...
How severe is CVE-2022-50944?
CVE-2022-50944 has been rated HIGH with a CVSS base score of 8.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-50944?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.