Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-26149. PoCs published by Sarang Tumne.
AI-analyzed exploit summary This exploit demonstrates an authenticated remote code execution (RCE) vulnerability in MODX Revolution v2.8.3-pl by abusing the file upload functionality to upload a malicious PHP shell. The attacker must first authenticate as an admin and modify system settings to allow PHP file uploads.
Description
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.
Exploits (1)
This exploit demonstrates an authenticated remote code execution (RCE) vulnerability in MODX Revolution v2.8.3-pl by abusing the file upload functionality to upload a malicious PHP shell. The attacker must first authenticate as an admin and modify system settings to allow PHP file uploads.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H