CVE-2022-24637
60Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 99%
from disclosure to weapon165 days
Published on NVDMar 18
1st PoC+165d
metasploitMar 18
exploitation probability
99%top 1% of all CVEs
observed exploitation
nono source reports it
9 public exploit(s)
Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
Affected products
n/a · n/apublic PoCs found — 9
exploitdbwww.exploit-db.com/exploits/51026unverifiedgithubgithub.com/hupe1980/CVE-2022-24637★ 5githubgithub.com/Lay0us/CVE-2022-24637★ 5githubgithub.com/Pflegusch/CVE-2022-24637★ 4githubgithub.com/icebreack/CVE-2022-24637★ 4githubgithub.com/0xM4hm0ud/CVE-2022-24637★ 3githubgithub.com/0xRyuk/CVE-2022-24637★ 1cve_referencepacketstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.htmlunverifiedcve_referencepacketstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.htmlunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
References
http://packetstormsecurity.com/files/169811/Open-Web-Analytics-1.7.3-Remote-Code-Execution.htmlhttp://packetstormsecurity.com/files/171389/Open-Web-Analytics-1.7.3-Remote-Code-Execution.htmlhttps://devel0pment.de/?p=2494https://github.com/Open-Web-Analytics/Open-Web-Analytics/releases/tag/1.7.4