CVEvulnerability
CVE-2022-27061
7.2 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-04-08
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
AeroCMS v0.0.1 was discovered to contain an arbitrary file upload vulnerability via the Post Image function under the Admin panel. This vulnerability allows attackers to execute arbitrary code via a crafted PHP file.
Affected configurations
• aerocms project aerocms 0.0.1
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- http://packetstormsecurity.com/files/166659/AeroCMS-0.0.1-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
- https://drive.google.com/file/d/1PdF7gTUt_QuU2ObS9YUVew6orHaho-QF/view?usp=sharing Exploit, Third Party Advisory
- https://github.com/D4rkP0w4r/AeroCMS-Unrestricted-File-Upload-POC Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/166659/AeroCMS-0.0.1-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
- https://drive.google.com/file/d/1PdF7gTUt_QuU2ObS9YUVew6orHaho-QF/view?usp=sharing Exploit, Third Party Advisory
- https://github.com/D4rkP0w4r/AeroCMS-Unrestricted-File-Upload-POC Exploit, Third Party Advisory