CVE-2022-23043: File upload restriction bypass in Zenario CMS

February 24, 2022 (updated March 3, 2022)

Zenario CMS 9.2 allows an authenticated admin user to bypass the file upload restriction by creating a new ‘File/MIME Types’ using the ‘.phar’ extension. Then an attacker can upload a malicious file, intercept the request and change the extension to ‘.phar’ in order to run commands on the server.

References

fluidattacks.com/advisories/simone/
github.com/TribalSystems/Zenario/commit/f0682d22688d9921dc0dfd6e858900ebf2706f19
github.com/TribalSystems/Zenario/releases/tag/9.2.55826
github.com/advisories/GHSA-6r86-2jm9-9mh4
nvd.nist.gov/vuln/detail/CVE-2022-23043

Code Behaviors & Features

Detect and mitigate CVE-2022-23043 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →