CVE-2022-50993 - Vulnerability Analysis

Overview

Weaver (Fanwei) E-office < 10.0_20221201 contains an unauthenticated arbitrary file upload vulnerability in OfficeServer.php, letting remote attackers upload and execute malicious PHP webshells, exploit requires no authentication.

Severity & Score

Impact

Remote attackers can upload and execute arbitrary code as the web server user, leading to full server compromise.

Mitigation

Update to version 10.0_20221201 or later.

References

• https://service.e-office.cn/knowledge/detail/5
• https://www.vulncheck.com/advisories/weaver-e-office-10-0-20221201-unauthenticated-arbitrary-file-read-via-xmlrpcservlet
• https://www.cve.org/CVERecord?id=CVE-2022-50993
• https://bbs.chaitin.cn/topic/37
• https://cn-sec.com/archives/1453025.html

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner