CVE-2022-3552

Unrestricted Upload of File with Dangerous Type in boxbilling/boxbilling

CVSS 7.2 HIGHEPSS 44.0%CWE-434

Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1.

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

boxbilling · boxbilling/boxbilling

public PoCs found — 4

githubgithub.com/0xk4b1r/CVE-2022-3552★ 8 githubgithub.com/BakalMode/CVE-2022-3552★ 2 cve_referencepacketstormsecurity.com/files/171542/BoxBilling-4.22.1.5-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/51108unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

http://packetstormsecurity.com/files/171542/BoxBilling-4.22.1.5-Remote-Code-Execution.html https://github.com/boxbilling/boxbilling/commit/b6705995785eaa8653e876318c9b3d82060dc945 https://huntr.dev/bounties/c6e2973d-386d-4667-9426-10d10828539b