CVE-2022-22828

HIGH

Synaman < 5.0 - Unauthenticated Unshared File Access via Base64-Encoded Filename

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-22828. PoCs published by videnlabs.

AI-analyzed exploit summary This repository documents an Insecure Direct Object Reference (IDOR) vulnerability in Synametrics SynaMan version 4.9 and earlier. The vulnerability allows unauthorized access to files in a user's home folder by manipulating a base64-encoded filename parameter in a GET request.

Description

An insecure direct object reference for the file-download URL in Synametrics SynaMan before 5.0 allows a remote attacker to access unshared files via a modified base64-encoded filename string.

Exploits (1)

nomisec WRITEUP

by videnlabs · poc

https://github.com/videnlabs/CVE-2022-22828

View Code ZIP pw:eip

This repository documents an Insecure Direct Object Reference (IDOR) vulnerability in Synametrics SynaMan version 4.9 and earlier. The vulnerability allows unauthorized access to files in a user's home folder by manipulating a base64-encoded filename parameter in a GET request.

Classification

Writeup 90%

Attack Type

Auth Bypass

Complexity

Trivial

Reliability

Reliable

Target: Synametrics SynaMan version 4.9 and earlier

No auth needed

Prerequisites: Access to a download link containing a base64-encoded filename parameter · Knowledge or ability to guess filenames in the target user's home folder

MITRE ATT&CK

T1222 - File and Directory Permissions Modification

devstral-2 · analyzed Feb 16, 2026 Full analysis →