bbs.chaitin.cnTechnical descriptionexploit
https://bbs.chaitin.cn/topic/37 CVE-2022-50993
CRITICAL
Weaver E-office < 10.0_20221201 Unauthenticated Arbitrary File Read via XmlRpcServlet
Record summary
CVE-2022-50993 has a selected CVSS score of 9.3 (critical).
Description
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).
Description source: CVE List
Exploitation context
Known exploitation
- VulnCheck KEV
- Listed · Apr 30, 2026 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
CISA SSVC decision
ExploitationPoC
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Apr 30, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Default status: affected | CVE List, VulnCheck | Before 10.0_20221201 | affected |
References
5cn-sec.comTechnical descriptionexploit
https://cn-sec.com/archives/1453025.html nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-50993 service.e-office.cnrelease notespatch
https://service.e-office.cn/knowledge/detail/5 vulncheck.comThird-party advisory
https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet