CVE-2022-25578
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk74th percentile - higher than 74% of all known CVEs
Summary
A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.
Risk Assessment
The risk for the organization includes full server compromise, which can lead to data theft, website defacement, or using the server for further attacks.
Recommendation
It is recommended to immediately update taocms to the latest version and restrict permissions to edit the .htaccess file only to trusted administrators.
Other vulnerabilities in taocms
See all- CVE-2022-36262Critical
An issue was discovered in taocms 3.0.2 in the website settings that allows arbitrary PHP code to be injected by modifying config.php.
- CVE-2023-34654Medium
Taocms versions up to 3.0.2 are vulnerable to Cross Site Scripting (XSS), allowing attackers to inject malicious code into the application.
Original NVD description (English source)
taocms v3.0.2 allows attackers to execute code injection via arbitrarily editing the .htaccess file.