CVE-2022-33941 Command injection in PowerCMS XMLRPC API

Critical 9.8 Published 8 Sep 2022 Updated 3 Aug 2024

Attackers can execute arbitrary OS commands via crafted POST requests to the PowerCMS XMLRPC API, leading to full system compromise.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-33941?

CVE-2022-33941 is a critical command injection vulnerability in Alfasado Inc. PowerCMS XMLRPC API, published on 8 Sep 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may be executed through it. Affected products/versions are as follows: PowerCMS 6.021 and earlier (PowerCMS 6 Series), PowerCMS 5.21 and earlier (PowerCMS 5 Series), and PowerCMS 4.51 and earlier (PowerCMS 4 Series). Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.

Weakness: CWE-78

Which versions are affected by CVE-2022-33941?

It affects 1 product.

Products include Alfasado Powercms.

How do I fix CVE-2022-33941?

No fix has been published for CVE-2022-33941 yet. Limit exposure of the affected software until one is available.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2022-33941 being exploited?

There is no known exploitation of CVE-2022-33941 in the wild and no public exploit code.

Sources

Also known as GHSA-3gg6-g739-g8w9.