Strix
26.1K

CVE-2022-50806

HIGHCVSS 8.6/10EPSS 1.09%

Last modified

CVE-2022-50806 is a high-severity vulnerability rated 8.6/10 on the CVSS scale. 4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter.. EPSS estimates a 1.09% chance of exploitation in the next 30 days.

Description

4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter.

Metrics

CVSS 3.1
7.2/10

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CVSS 4.0
8.6/10

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS Probability
1.09%

61.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

VendorProductVersions
4homepages4images1.9

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2022-50806?
4images 1.9 contains a remote command execution vulnerability that allows authenticated administrators to inject reverse shell code through template editing functionality. Attackers can save malicious code in the template and execute arbitrary commands by accessing a specific categories.php endpoint with a crafted cat_id parameter.
How severe is CVE-2022-50806?
CVE-2022-50806 has a CVSS score of 8.6/10 (HIGH severity). The EPSS model estimates a 1.09% probability of exploitation in the next 30 days.
How do I fix CVE-2022-50806?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2022-50806?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST