CVE-2022-50806
HIGH4images 1.9 - Authenticated Remote Code Execution via Template Editing and Categories Endpoint
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2022-50806. PoCs published by Andrey Stoykov.
AI-analyzed exploit summary This exploit demonstrates a Remote Command Execution (RCE) vulnerability in 4images 1.9 by injecting a reverse shell payload into the 'categories.html' template via the admin interface. The payload is executed when accessing the manipulated template.
Description
4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter.
Exploits (1)
This exploit demonstrates a Remote Command Execution (RCE) vulnerability in 4images 1.9 by injecting a reverse shell payload into the 'categories.html' template via the admin interface. The payload is executed when accessing the manipulated template.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H