CVE-2022-51022
criticalYiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that all…
YiShaAdmin 2.2 through 3.1, fixed in commit 025b062, contains an unauthenticated path traversal vulnerability in the /admin/File/DownloadFile endpoint that allows attackers to read and delete arbitrary files via the filePath parameter. Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Exploitation evidence was first observed by the Shadowserver Foundation on 2023-10-20.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H Affected products
Not reported by the source (unknown — not "none").
Weakness classification (CWE)
Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.
Mitigation & advisories
No vendor advisory or patch reference tagged by NVD. Check the references below.
References
- https://github.com/liukuo362573/YiShaAdmin/commit/025b0628b1295bd2d9fd6c9b5b82692a345151ef disclosure@vulncheck.com
- https://github.com/liukuo362573/YiShaAdmin/commit/c3b66e66bf6d70a561190cd8da7f4df7b141931d disclosure@vulncheck.com
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/... disclosure@vulncheck.com
- https://huntr.com/bounties/2acdd87a-12bd-4ce4-994b-0081eb908128 disclosure@vulncheck.com
- https://www.vulncheck.com/advisories/yishaadmin-3.1-unauthenticated-path-traversal-via-dow... disclosure@vulncheck.com