Insecure Permission Vulnerability in SCHLIX CMS by Schlix Web Inc
CVE-2022-45544
Key Information:
Badges
What is CVE-2022-45544?
The SCHLIX CMS version 2.2.7-2 is affected by a vulnerability that enables arbitrary file uploads and potential code execution through the tristao parameter. While the vendor asserts that only administrators can upload executable PHP files, the implications of this vulnerability warrant caution. Attackers could exploit misconfigurations or social engineering tactics to gain admin access, making this a critical issue for website security. It is crucial for administrators to ensure strict access controls and validate all uploaded content to safeguard against potential exploitation.
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.