CVE-2022-28118

CRITICAL

SiteServer CMS 7.0.0-7.1.2 - Remote Code Execution via Crafted Plugin

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2022-28118. PoCs published by Richard-Tang.

AI-analyzed exploit summary This repository contains a proof-of-concept exploit for CVE-2022-28118, targeting SSCMS. The exploit leverages file upload vulnerabilities in the advertisement management functionality to achieve remote code execution (RCE).

Description

SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in.

Exploits (1)

nomisec WORKING POC 8 stars

by Richard-Tang · poc

https://github.com/Richard-Tang/SSCMS-PluginShell

View Code ZIP pw:eip

This repository contains a proof-of-concept exploit for CVE-2022-28118, targeting SSCMS. The exploit leverages file upload vulnerabilities in the advertisement management functionality to achieve remote code execution (RCE).

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Moderate

Reliability

Reliable

Target: SSCMS (SiteServer CMS)

Auth required

Prerequisites: Authenticated access to the SSCMS admin panel · File upload functionality enabled in the advertisement module

MITRE ATT&CK