CVE-2022-50944 - Vulnerability Analysis

Overview

Aero CMS 0.0.1 contains a command injection caused by uploading malicious PHP files through the image parameter in admin posts.php with source=add_post, letting authenticated attackers execute arbitrary PHP code.

Severity & Score

Impact

Authenticated attackers can execute arbitrary PHP code on the server, potentially leading to full system compromise.

Mitigation

Update to the latest version with proper file upload validation and sanitization.

References

• https://www.exploit-db.com/exploits/51085
• https://www.vulncheck.com/advisories/aero-cms-php-code-injection-via-posts-php
• https://github.com/MegaTKC/AeroCMS

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner