Exploitation Summary
EIP tracks 1 public exploit for CVE-2022-50944. PoCs published by Hubert Wojciechowski.
AI-analyzed exploit summary This exploit demonstrates a PHP code injection vulnerability in Aero CMS v0.0.1 by uploading a malicious PHP file disguised as an image. The payload includes a DNS callback to confirm execution, proving remote code execution (RCE) via file upload.
Description
Aero CMS 0.0.1 contains a PHP code injection vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious files through the image parameter. Attackers can upload PHP files with embedded code to the admin posts.php endpoint with source=add_post parameter, and the uploaded files are executed by the server.
Exploits (1)
This exploit demonstrates a PHP code injection vulnerability in Aero CMS v0.0.1 by uploading a malicious PHP file disguised as an image. The payload includes a DNS callback to confirm execution, proving remote code execution (RCE) via file upload.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H