CVE-2022-45771

HIGH

Pwndoc - Unrestricted File Upload

Title source: rule
STIX 2.1

Description

An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate privileges and execute arbitrary code via uploading a crafted audit file.

Exploits (2)

nomisec WORKING POC 47 stars
by p0dalirius · poc
https://github.com/p0dalirius/CVE-2022-45771-Pwndoc-LFI-to-RCE
nomisec WORKING POC 6 stars
by yuriisanin · poc
https://github.com/yuriisanin/CVE-2022-45771

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory
https://github.com/pwndoc/pwndoc/issues/401

Scores

CVSS v3 8.8
EPSS 0.3031
EPSS Percentile 96.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact total

Details

CWE
CWE-434
Status published
Products (1)
pwndoc_project/pwndoc 0.5.3
Published Dec 05, 2022
Tracked Since Feb 18, 2026