GitHub Advisoryadvisory · Packagist
GHSA-fwvc-9xhj-26v5 Badaso vulnerable to Remote Code Execution via malicious file upload
CRITICAL
Official page ↗
- Aliases
- CVE-2022-41711
- Ecosystem
- Packagist
- Packages
- badaso/core
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-434
- Reviewed
- 2022-10-26
Affected packages
• Packagist badaso/core: < 2.6.1 → fixed in 2.6.1
Description
Badaso allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.
Related
Alias · CVE (1)
- CVE-2022-41711 Badaso version 2.6.0 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. vulnerability
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2022-41711 advisory
- https://github.com/uasoft-indonesia/badaso/issues/802 web
- https://github.com/uasoft-indonesia/badaso/commit/22250eca7c364d991ce9e0a723941eae4889d6f9 web
- https://fluidattacks.com/advisories/harlow web
- https://github.com/uasoft-indonesia/badaso package