CVE-2022-23940

HIGH
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2022-23940 has a selected CVSS score of 8.8 (high); EIP currently links 1 repository PoC and 1 lab environment.

Description

SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. Authenticated users with access to the Scheduled Reports module can achieve this by leveraging PHP deserialization in the email_recipients property. By using a crafted request, they can create a malicious report, containing a PHP-deserialization payload in the email_recipients field. Once someone accesses this report, the backend will deserialize the content of the email_recipients field and the payload gets executed. Project dependencies include a number of interesting PHP deserialization gadgets (e.g., Monolog/RCE1 from phpggc) that can be used for Code Execution.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Lab environments
1

Proofs of concept

1

Repository PoCs

GitHubmanuelz120/CVE-2022-23940Repository PoCby manuelz12014Not analyzed8 files

155.0 KiB

GitHub
PoC details

Docker lab environments

1
GitHub

vulnerable/docker-compose.yml

manuelz120/CVE-2022-23940Created Vuln labCVE-2022-23940Compose · images

1 Compose manifest · 2 services

View exploit
Analysisdeepseek-v4-pro:cloud ·

Environment assessment

A Docker Compose environment defining a SuiteCRM 7.11.8 instance with a MariaDB 10.3 database, exposing HTTP/HTTPS ports. The README labels it as a vulnerable instance and provides credentials.

vulnerable/docker-compose.yml:1-32vulnerable/README.md:1-6

Lab assessment

Vulnerability lab

The README explicitly states 'Vulnerable SCRM Instance' and the repository is named after CVE-2022-23940, indicating a deliberate vulnerability research or reproduction environment.

vulnerable/README.md:1vulnerable/docker-compose.yml:1-32
Lab shapeCompose · images
Services2
Compose manifests1
Dockerfiles0
Evidence & reasoningComponents · CVE assessment · exercise context · review boundaries
Components

Services and files described by the evidence

mariadb

database

MariaDB 10.3 service using the Bitnami image, configured with empty password allowed, a user 'bn_suitecrm', and a database 'bitnami_suitecrm'. Data persisted via named volume.

vulnerable/docker-compose.yml:3-10

suitecrm

web applicationvulnerable target

SuiteCRM 7.11.8 service using the Bitnami image, exposing ports 80 and 443, connected to the mariadb service. Configured with empty password allowed. Data persisted via named volume. Depends on mariadb.

vulnerable/docker-compose.yml:11-26
CVE assessment

How the supplied evidence relates each vulnerability

CVE-2022-23940

Insufficient evidence

The repository name and README reference CVE-2022-23940, but the supplied evidence (Compose file and README) does not contain any details about the vulnerability, its reproduction steps, or how the environment demonstrates it. The association is based solely on naming, not on visible behavior or configuration.

vulnerable/README.md:1vulnerable/docker-compose.yml:1-32
Exercise context

Requirements and sequence described by the evidence

Prerequisites

  • Docker and Docker Compose must be installed to run the environment.vulnerable/docker-compose.yml:1
  • The SuiteCRM instance is accessible on host ports 80 and 443.vulnerable/docker-compose.yml:13-14
  • Credentials 'user' / 'bitnami' are provided for the SuiteCRM instance.vulnerable/README.md:5-6
Safety-review evidence

Behaviors behind the stored safety assessment

Insufficient evidence

The evidence only shows a standard Docker Compose setup for a vulnerable SuiteCRM instance. No exploit code, scripts, or instructions are included. The environment does not exhibit any behavior beyond exposing the application on host ports, which is expected for a lab. However, without any exercise steps or exploit payloads, the safety of the intended use cannot be fully assessed.

vulnerable/docker-compose.yml:1-32vulnerable/README.md:1-6
Review boundaries

What the analysis did not establish

  • No exploit code, scripts, or detailed vulnerability reproduction steps are included in the packet.
  • The CVE association is based solely on repository naming; no technical details about CVE-2022-23940 are present.
  • The requirements.txt file is present in the repository but not part of the unit; its role is unclear.
  • The packet contains only static configuration; runtime behavior cannot be observed.
Model interpretation

This review is limited to the supplied lab evidence packet. It does not assert that the environment runs, reproduces a vulnerability, or is safe to execute. Contract: eip-docker-lab-analysis-v1.

References

3