Deserialization Vulnerability in Phpok Affecting QingGan
CVE-2022-29363

9.8CRITICAL

Key Information:

Vendor

PHPok

Status
PHPok
Vendor
CVE Published:
12 May 2022

What is CVE-2022-29363?

A deserialization vulnerability has been identified in Phpok v6.1, specifically within the update_f() function found in login_control.php. This flaw enables attackers to exploit the system by writing arbitrary files, potentially leading to unauthorized access and further exploitation. Organizations using this affected version must take immediate steps to mitigate risks associated with this vulnerability.

References

https://github.com/qinggan/phpok/issues/12
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.