CVE-2022-23043

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new 'File/MIME Types' using the '.phar' extension. Then an attacker can upload a malicious file, intercept the request and change the extension to '.phar' in order to run commands on the server.

• CWE-434

• https://fluidattacks.com/advisories/simone/Exploit, Patch, Third Party Advisory
• https://github.com/TribalSystems/Zenario/releases/tag/9.2.55826Patch, Release Notes, Third Party Advisory
• https://fluidattacks.com/advisories/simone/Exploit, Patch, Third Party Advisory
• https://github.com/TribalSystems/Zenario/releases/tag/9.2.55826Patch, Release Notes, Third Party Advisory

Published

Feb 24, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-23038Linux PV device frontends vulnerable to attacks by backends …7
• CVE-2022-23039Linux PV device frontends vulnerable to attacks by backends …7
• CVE-2022-2304Stack-based Buffer Overflow in GitHub repository vim/vim pri…7.8
• CVE-2022-23040Linux PV device frontends vulnerable to attacks by backends …7
• CVE-2022-23041Linux PV device frontends vulnerable to attacks by backends …7
• CVE-2022-23042Linux PV device frontends vulnerable to attacks by backends …7
• CVE-2022-23044Tiny File Manager version 2.4.8 allows an unauthenticated re…8.8
• CVE-2022-23045PhpIPAM v1.4.4 allows an authenticated admin user to inject …4.8
• CVE-2022-23046PhpIPAM v1.4.4 allows an authenticated admin user to inject …7.2
• CVE-2022-23047Exponent CMS 2.6.0patch2 allows an authenticated admin user …4.8
• CVE-2022-23048Exponent CMS 2.6.0patch2 allows an authenticated admin user …7.2
• CVE-2022-23049Exponent CMS 2.6.0patch2 allows an authenticated user to inj…5.4