CVE-2022-24387 File upload and overwrite to app_data/Config in SmarterTrack v100.0.8019.14010
Administrators can overwrite critical configuration files via file upload, potentially leading to code execution or privilege escalation in SmarterTrack.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-24387?
CVE-2022-24387 is a critical vulnerability in SmarterTools SmarterTrack, published on 14 Mar 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
With administrator or admin privileges the application can be tricked into overwriting files in app_data/Config folder, e.g. the systemsettings.xml file. THis is possible in SmarterTrack v100.0.8019.14010
Weakness: CWE-434
Which versions are affected by CVE-2022-24387?
It affects 1 product.
Products include Smartertools Smartertrack.
How do I fix CVE-2022-24387?
No fix has been published for CVE-2022-24387 yet. Limit exposure of the affected software until one is available.
Is CVE-2022-24387 being exploited?
There is no known exploitation of CVE-2022-24387 in the wild and no public exploit code.
Other vulnerabilities in SmarterTools SmarterTrack
- CVE-2022-24384 Reflective XSS on SmarterTrack v100.0.8019.14010
- CVE-2022-24386 Stored XSS in SmarterTrack v100.0.8019.14010
- CVE-2020-36926 SmarterTools SmarterTrack 7922 -Information Disclosure
- CVE-2022-24385 Information disclosure via direct object access on SmarterTrack v100.0.8019.14010
- CVE-2009-4994 Cross-site scripting in n/a
Sources
Also known as GHSA-38pg-fhjw-6gv5.