Vulnerability DatabaseCVE-2022-41711

CVE-2022-41711:
PHP vulnerability analysis and mitigation

Overview

Badaso version 2.6.0 contains a critical remote code execution vulnerability (CVE-2022-41711) that allows unauthenticated remote attackers to execute arbitrary code on the server. The vulnerability was discovered on October 5, 2022, and was patched in version 2.6.1 (Fluid Attacks).

Technical details

The vulnerability occurs due to improper validation of user-uploaded files in the application. Attackers can bypass security controls by including an XML header before malicious PHP code instead of uploading a legitimate image file. The vulnerability has been assigned a CVSSv3.1 Base Score of 10.0 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H (Fluid Attacks).

Impact

This vulnerability allows unauthenticated attackers to execute arbitrary code remotely on the server, potentially leading to complete system compromise. The critical severity rating and maximum CVSS score indicate that successful exploitation could result in total loss of confidentiality, integrity, and availability of the affected system (Fluid Attacks).

Mitigation and workarounds

The vulnerability has been patched in Badaso version 2.6.1. Users are strongly recommended to upgrade to the latest version available from the vendor's repository (Fluid Attacks, GitHub Issue).

Community reactions

The vulnerability was responsibly disclosed to the vendor on October 5, 2022. The vendor acknowledged and confirmed the vulnerability on the same day, and a patch was released on October 11, 2022. The public disclosure was made on October 18, 2022 (Fluid Attacks).