CVE-2022-37190

HIGHNuclei

Cuppa CMS v1.0 - Remote Code Execution

Title source: github.com
STIX 2.1 vulnerability

Record summary

CVE-2022-37190 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.

Description source: CVE List

Exploitation context

Available material

Nuclei templates
1

Nuclei templates

1
ProjectDiscoveryHIGHCuppa CMS v1.0 - Remote Code ExecutionCVSS 8.8

CuppaCMS 1.0 is vulnerable to Remote Code Execution (RCE). An authenticated user can control both parameters (action and function) from "/api/index.php.

Impact

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.

Remediation

Apply the latest security patch or update to a patched version of Cuppa CMS v1.0 to mitigate this vulnerability.

WeaknessesCWE-732
Authorstheamanrawat
Template tagscve2022cvercecuppaauthenticatedcuppacmsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:cuppacms:cuppacms:1.0:*:*:*:*:*:*:*
https://github.com/CuppaCMS/CuppaCMS https://nvd.nist.gov/vuln/detail/CVE-2022-37190 https://github.com/ARPSyndicate/cvemon

Source: ProjectDiscovery

References

3