CVE-2022-4276 - House Rental System POST Request tenant-engine.php unrestricted upload

Back Back to CVE browser

CRITICAL

House Rental System POST Request tenant-engine.php unrestricted upload

Published Dec 3, 2022

9.8

CRITICAL

CVSS 3.1

EPSS 0.62%

Description

A vulnerability was found in House Rental System and classified as critical. Affected by this issue is some unknown functionality of the file tenant-engine.php of the component POST Request Handler. The manipulation of the argument id_photo leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-214772.

Affected products

Vendor n/a Product House Rental System Default
n/a

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

House Rental System

n/a

Version	Status	Constraints

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-266

Incorrect Privilege Assignment

CWE-434

Unrestricted Upload of File

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51632
Advisory
https://github.com/nikeshtiwari1/House-Rental-System/issues/8
ExploitIssue TrackingThird Party Advisory
https://vuldb.com/?id.214772
Permissions RequiredThird Party AdvisoryVDB Entry

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-51632		Advisory
https://github.com/nikeshtiwari1/House-Rental-System/issues/8		ExploitIssue TrackingThird Party Advisory
https://vuldb.com/?id.214772		Permissions RequiredThird Party AdvisoryVDB Entry