GitHub Advisoryadvisory · Packagist

GHSA-g389-rf5p-fg56 Badaso vulnerable to Remote Code Execution (RCE)

CRITICAL Published 2022-11-25 Modified 2025-04-29 Official page ↗

Aliases: CVE-2022-41705
Ecosystem: Packagist
Packages: badaso/core
Severity: Critical
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses: CWE-434, CWE-94
Reviewed: 2022-12-02

Affected packages

• Packagist badaso/core: < 2.7.0 → fixed in 2.7.0

Description

Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. This is possible because the application does not properly validate the data uploaded by users.

Alias · CVE (1)

CVE-2022-41705 Badaso version 2.6.3 allows an unauthenticated remote attacker to execute arbitrary code remotely on the server. vulnerability

Weakness · CWE (2)

CWE-434 Unrestricted Upload of File with Dangerous Type weakness
CWE-94 Improper Control of Generation of Code weakness

References

https://nvd.nist.gov/vuln/detail/CVE-2022-41705 advisory
https://github.com/uasoft-indonesia/badaso/issues/818 web
https://fluidattacks.com/advisories/headhunterz web
https://github.com/uasoft-indonesia/badaso package