CVE-2022-24688

Katalog CVE

CVSS 8.8 · High EPSS 4,0%

Kerentanan Unrestricted Upload of File with Dangerous Type pada dsknet. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.

Rincian

Terbit di NVD

18 Juli 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

4,0% peluang dieksploitasi; lebih tinggi dari 90,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://dsk.lu/fr/produits/temps-de-presence advisory vendor
• https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf exploit · advisory pihak ketiga