.. / CVE-2022-26159

• Info Disclosure
• Nuclei
• Web

Exploit for Ametys CMS Information Disclosure (CVE-2022-26159)

Description:

Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/domain/en.xml (and similar pathnames for other languages) via the auto-completion plugin, which contain all characters typed by all users, including the content of private pages. For example, a private page may contain usernames, e-mail addresses, and possibly passwords.

Nuclei Template

View the template here CVE-2022-26159.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-26159.yaml

References: