CVE-2022-51022: YiShaAdmin 2.2 through 3.1

Affected technology

YiShaAdmin · 2.2 through 3.1
liukuo362573

Description’s affected range: through 3.1, fixed in commit 025b062,

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

Attackers can send crafted GET requests with directory traversal sequences in filePath and set the delete parameter to read or remove system files like etc/passwd. Vendor/CNA’s CVSS 4.0 assessment (base score 8.8/10) rates confidentiality and availability impact as high; integrity impact as none.