CVE-2022-50791

Description

SOUND4 IMPACT/FIRST/PULSE/Eco <=2.x contains a conditional command injection vulnerability that allows local authenticated users to create malicious files in the /tmp directory. Unauthenticated attackers can execute commands by making a single HTTP POST request to the vulnerable ping.php script, which triggers the malicious file and then deletes it.

Weakness classification

• disclosure@vulncheck.com: CWE-78

Primary references

• disclosure@vulncheck.com — Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory, VDB Entry
• disclosure@vulncheck.com — Product
• disclosure@vulncheck.com — Third Party Advisory
• disclosure@vulncheck.com — Exploit, Third Party Advisory