Vulnerability Details CVE-2022-45544
Insecure Permission vulnerability in Schlix Web Inc SCHLIX CMS 2.2.7-2 allows attacker to upload arbitrary files and execute arbitrary code via the tristao parameter. NOTE: this is disputed by the vendor because an admin is intentionally allowed to upload new executable PHP code, such as a theme that was obtained from a trusted source or was developed for their own website. Only an admin can upload such code, not someone else in an "attacker" role.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 73.3%
CVSS Severity
CVSS v3 Score 8.8
References
- https://blog.tristaomarinho.com/schlix-cms-2-2-7-2-arbitrary-file-upload/
- https://github.com/tristao-marinho/CVE-2022-45544/blob/main/README.md
- https://www.schlix.com/
- https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.7-2.zip
- https://blog.tristaomarinho.com/schlix-cms-2-2-7-2-arbitrary-file-upload/
- https://github.com/tristao-marinho/CVE-2022-45544/blob/main/README.md
- https://www.schlix.com/
- https://www.schlix.com/downloads/schlix-cms/schlix-cms-v2.2.7-2.zip