CVE-2022-24934
CRITICAL EXPLOITEDKingsoft WPS Office < 11.2.0.10382 - Remote Code Execution via Registry Modification
Title source: llmExploitation Summary
CVE-2022-24934 has been observed exploited in the wild (reported by VulnCheck KEV). EIP tracks 4 public exploits from researchers including webraybtl, MagicPiperSec, ASkyeye.
AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2022-24934, which leverages a vulnerability in WPS Office's update mechanism to achieve arbitrary code execution by manipulating the update server address in the registry.
Description
wpsupdater.exe in Kingsoft WPS Office through 11.2.0.10382 allows remote code execution by modifying HKEY_CURRENT_USER in the registry.
Exploits (4)
This repository contains a proof-of-concept exploit for CVE-2022-24934, which leverages a vulnerability in WPS Office's update mechanism to achieve arbitrary code execution by manipulating the update server address in the registry.
This repository provides a fake WPS Update Server PoC for CVE-2022-24934, which exploits a vulnerability in WPS Office by serving a malicious file disguised as an update. The server requires a SigThief-ed file to bypass signature checks and includes an EICAR test signature to prevent direct misuse.
This repository provides a fake WPS Update Server PoC for CVE-2022-24934, exploiting a vulnerability in WPS Office via wpsupdate.exe. It requires a SigThief-ed malicious file and serves it over HTTP to trigger the vulnerability.
This repository contains only a README with images and no exploit code. It appears to be a writeup or documentation for CVE-2022-24934 but lacks any functional PoC or technical details.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H