CVE-2022-50893
CriticalSummary
VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a malicious PHP file via the add_gallery_image.php endpoint to execute arbitrary code on the server.
Risk Assessment
The vulnerability allows a remote unauthenticated attacker to fully compromise the server, potentially leading to data theft, content modification, or use of the server for further attacks.
Recommendation
Immediately restrict access to the add_gallery_image.php endpoint and implement file type validation. Update the software or apply security patches if available.
Original NVD description (English source)
VIAVIWEB Wallpaper Admin 1.0 contains an unauthenticated remote code execution vulnerability in the image upload functionality. Attackers can upload a malicious PHP file through the add_gallery_image.php endpoint to execute arbitrary code on the server.