CVE-2022-36262
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk70th percentile - higher than 70% of all known CVEs
Summary
An issue was discovered in taocms 3.0.2 in the website settings that allows arbitrary PHP code to be injected by modifying config.php.
Risk Assessment
An attacker can take over the server by executing malicious PHP code, leading to full system and data compromise.
Recommendation
Immediately update taocms to the latest version and restrict permissions on config.php to prevent unauthorized modification.
Other vulnerabilities in taocms
See all- CVE-2022-25578Critical
A vulnerability in taocms v3.0.2 allows attackers to inject code by arbitrarily editing the .htaccess file. Attackers can modify this file to execute malicious commands on the server.
- CVE-2023-34654Medium
Taocms versions up to 3.0.2 are vulnerable to Cross Site Scripting (XSS), allowing attackers to inject malicious code into the application.
Original NVD description (English source)
An issue was discovered in taocms 3.0.2. in the website settings that allows arbitrary php code to be injected by modifying config.php.