Unrestricted File Upload in Backdrop CMS Affects Remote Code Execution
CVE-2022-42092
7.2HIGH
Key Information:
- Vendor
Backdropcms
- Status
- Vendor
- CVE Published:
- 7 October 2022
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2022-42092?
Backdrop CMS version 1.22.0 is susceptible to an Unrestricted File Upload vulnerability that can potentially allow an attacker to execute arbitrary code remotely. This flaw is introduced through the 'themes' feature, which does not properly restrict file uploads, leading to severe security concerns. While some external parties claim that advanced permission settings mitigate the risk, it highlights the importance of stringent file validation protocols in maintaining system integrity.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.