CVE-2022-26645
CriticalCVSS 9.8Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.
Risk Assessment
An attacker can take over the server, access sensitive banking data, and conduct further attacks on the organization's infrastructure.
Recommendation
Immediately update the system to the latest version or apply a security patch, and implement file type validation and script execution restrictions in the upload directory.
Other vulnerabilities in Online Banking System Protect
See all- CVE-2022-26646Critical
Online Banking System Protect v1.0 contains a local file inclusion (LFI) vulnerability via the pages parameter. This allows an attacker to read sensitive files on the server.
- CVE-2022-26644Medium
Online Banking System Protect v1.0 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities via parameters on user profile, system_info and accounts management.
Original NVD description (English source)
A remote code execution (RCE) vulnerability in Online Banking System Protect v1.0 allows attackers to execute arbitrary code via a crafted PHP file uploaded through the Upload Image function.