The School Management < 9.9.7 - Unauthenticated RCE via REST api
97Vexday Risk Score
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
ssvc Actcvss 9.8epss 64%
from disclosure to weapon0 days
Published on NVDJan 16
1st PoCMay 27
VulnCheckMay 20
exploitation probability
64%top 1% of all CVEs
observed exploitation
yesVulnCheck
7 public exploit(s)
The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Unknown · school-management-propublic PoCs found — 7
githubgithub.com/0xSojalSec/-CVE-2022-1609★ 3githubgithub.com/savior-only/CVE-2022-1609★ 1githubgithub.com/itworksig/cve-2022-1609-exploit★ 1githubgithub.com/0xSojalSec/CVE-2022-1609★ 0cve_referencewpscan.com/vulnerability/e2d546c9-85b6-47a4-b951-781b9ae5d0f2/unverifiedvulncheckvulncheck.com/xdb/c32c76ba709funverifiedvulncheckvulncheck.com/xdb/8725e385bc65unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.