CVE Vulnerability

CVE-2022-24688

An issue was discovered in DSK DSKNet 2.16.136.0 and 2.17.136.5. The Touch settings allow unrestricted file upload (and consequently Remote Code Execution) via PDF upload with PHP content and a .php extension. The attacker must hijack or obtain privileged user access to the Parameters page in order to exploit this issue. (That can be easily achieved by exploiting the Broken Access Control with further Brute-force attack or SQL Injection.) The uploaded file is stored within the database and copied to the sync web folder if the attacker visits a certain .php?action= page.

8.8 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://dsk.lu/fr/produits/temps-de-presence Vendor Advisory
https://github.com/post-cyberlabs/CVE-Advisory/blob/main/CVE-2022-24688-92.pdf Exploit Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:dsk:dsknet:2.17.136.5:*:*:*:*:*:*:*
cpe:2.3:a:dsk:dsknet:2.16.136.0:*:*:*:*:*:*:*
Information

Published : 2022-07-18 01:15

Updated : 2022-07-25 06:06

NVD link : CVE-2022-24688

Mitre link : CVE-2022-24688

Products Affected
No products.
CWE
CWE-434