CVE-2022-50993
CriticalSummary
Weaver (Fanwei) E-office w wersjach przed 10.0_20221201 zawiera podatność na nieautoryzowane przesyłanie plików w punkcie końcowym OfficeServer.php. Umożliwia to zdalnym atakującym przesyłanie złośliwych plików poprzez wysyłanie wieloczęściowych żądań POST z dowolnymi nazwami plików i ukrytymi typami zawartości.
Risk Assessment
Atakujący mogą przesyłać skrypty PHP do katalogu Dokumentów i wykonywać je za pomocą żądań HTTP GET, co prowadzi do zdalnego wykonania kodu jako użytkownik serwera WWW. To stwarza poważne zagrożenie dla bezpieczeństwa systemu i danych organizacji.
Recommendation
Zaleca się aktualizację Weaver (Fanwei) E-office do wersji 10.0_20221201 lub nowszej, aby usunąć tę podatność. Dodatkowo, warto wdrożyć mechanizmy ograniczające możliwość przesyłania plików oraz monitorować ruch sieciowy w celu wykrywania podejrzanych działań.
Related vulnerabilities
- CVE-2026-95606Critical
Deserialization of untrusted data vulnerability in The Events Calendar plugin allows object injection. Affects versions up to 6.17.4.
- CVE-2026-95605Critical
SQL injection vulnerability in WP Data Access allows blind SQL injection. Affects versions up to 5.5.82.
- CVE-2026-76501Critical
Vulnerability in SRv6 OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM and SRv6 features are enabled.
- CVE-2026-76500Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper control of a resource through its lifetime (CWE-664). These have been addressed in hardening releases.
- CVE-2026-76499Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper neutralization issues (CWE-707). These have been addressed in hardening releases.
- CVE-2026-76498Critical
A security review in Cisco APIC revealed multiple vulnerabilities related to improper access control (CWE-284). These have been addressed in hardening releases.
- CVE-2026-76486Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76485Critical
Vulnerability in VXLAN OAM (NGOAM) feature of Cisco NX-OS allows unauthenticated remote attacker to execute arbitrary code with root privileges or cause DoS. Due to improper input validation when NGOAM is enabled.
- CVE-2026-76483Critical
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to insufficiently protected credentials (CWE-522). These have been addressed in hardening releases.
- CVE-2026-76482Critical
A security review in Cisco License On-Prem (formerly SSM On-Prem) revealed multiple vulnerabilities related to improper input verification (CWE-347). These have been addressed in hardening releases.
Original NVD description (English source)
Weaver (Fanwei) E-office versions prior to 10.0_20221201 contain an unauthenticated arbitrary file upload vulnerability in the OfficeServer.php endpoint that allows remote attackers to upload malicious files by sending multipart POST requests with arbitrary filenames and disguised content types. Attackers can upload PHP webshells to the Document directory and execute them via HTTP GET requests to achieve remote code execution as the web server user. Exploitation evidence was first observed by the Shadowserver Foundation on 2022-10-10 (UTC).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS