Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-50894. PoCs published by Edd13Mora.
AI-analyzed exploit summary This exploit demonstrates multiple vulnerabilities in VIAVIWEB Wallpaper Admin 1.0, including SQL injection on the login page and an unauthenticated remote code execution via file upload. The RCE is achieved by uploading a malicious PHP file disguised as an image.
Description
VIAVIWEB Wallpaper Admin 1.0 contains an SQL injection vulnerability that allows authenticated attackers to manipulate database queries by injecting SQL code through the img_id parameter. Attackers can send GET requests to edit_gallery_image.php with malicious img_id values to extract database information.
Exploits (1)
This exploit demonstrates multiple vulnerabilities in VIAVIWEB Wallpaper Admin 1.0, including SQL injection on the login page and an unauthenticated remote code execution via file upload. The RCE is achieved by uploading a malicious PHP file disguised as an image.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N