Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-3771

CVE-2022-3771: easyii CMS's File Upload Management vulnerable to unrestricted upload

9.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-3771
GHSA ID
GHSA-vqvm-qrwh-69h7
EPSS Score
0.19286%
CWE
CWE-284
Published
10/31/2022
Updated
1/30/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
noumo/easyiicomposer<= 0.9

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

  1. The vulnerability description explicitly references the 'file' function in helpers/Upload.php as the affected component.
  2. CWE-434 (Unrestricted Upload) indicates insufficient file type validation, which would be implemented in the core upload function.
  3. CWE-284 (Improper Access Control) suggests the function doesn't enforce authentication/authorization checks before processing uploads.
  4. The remote attack vector and critical CVSS score align with a fundamental lack of security controls in the primary upload handler.
  5. The component's name ('File Upload Management') and file path match typical patterns for core upload functionality in PHP CMS architectures.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

T*is issu* *****ts t** *un*tion *il* o* t** *il* **lp*rs/Uplo**.p*p o* t** *ompon*nt *il* Uplo** M*n***m*nt. T** m*nipul*tion l***s to unr*stri*t** uplo**. T** *tt**k m*y ** initi*t** r*mot*ly.

Reasoning

*. T** vuln*r**ility **s*ription *xpli*itly r***r*n**s t** '*il*' *un*tion in **lp*rs/Uplo**.p*p *s t** *****t** *ompon*nt. *. *W*-*** (Unr*stri*t** Uplo**) in*i**t*s insu**i*i*nt *il* typ* v*li**tion, w*i** woul* ** impl*m*nt** in t** *or* uplo** *u