VulnerabilityModified
CVE-2022-30007
GXCMS V1.5 has a file upload vulnerability in the background.
HIGH 7.2EPSS 0.96%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.96%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 0.96% probability · 60th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-434
- Affected
- gxcms project/gxcms
- Source
- cve@mitre.org
References
- https://github.com/ZackSecurity/VulnerReport/blob/cve/gxcms/1.md
- https://github.com/breezety/gxcms15/issues/1Exploit, Issue Tracking, Third Party Advisory
- https://github.com/ZackSecurity/VulnerReport/blob/cve/gxcms/1.md
- https://github.com/breezety/gxcms15/issues/1Exploit, Issue Tracking, Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.