CVE-2022-41573

CVE-2022-41573 is a vulnerability discovered in Ovidentia 8.3, affecting the file upload feature which fails to prevent the uploading of executable files. Specifically, an attacker can upload a file disguised with a .png extension but containing PHP code, then rename it to a .php extension. The file becomes accessible via an images/common/ URI, enabling remote code execution.

The vulnerability carries a CVSS v3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), marking it as critical. It can be exploited by any unauthenticated attacker over the network with low complexity and no user interaction required, resulting in high impacts to confidentiality, integrity, and availability through arbitrary remote code execution on the server.

References point to the Ovidentia Bitbucket repository branches, the Orange Cyberdefense CVE repository, and a proof-of-concept exploit script hosted in that repository at PoCs/poc_CVE-2022-41573.txt. No specific mitigation or patch details from advisories are detailed in the provided information.