.. / CVE-2022-32409

Exploit for Portal do Software Publico Brasileiro i3geo 7.0.5 - Local File Inclusion (CVE-2022-32409)

Description:

Portal do Software Publico Brasileiro i3geo 7.0.5 is vulnerable to local file inclusion in the component codemirror.php, which allows attackers to execute arbitrary PHP code via a crafted HTTP request.

Nuclei Template

View the template here CVE-2022-32409.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-32409.yaml
Copy

References:

https://github.com/ARPSyndicate/cvemon
https://nvd.nist.gov/vuln/detail/CVE-2022-32409
https://github.com/ARPSyndicate/kenzer-templates
https://owasp.org/www-project-web-security-testing-guide/v42/4-Web_Application_Security_Testing/07-Input_Validation_Testing/11.1-Testing_for_Local_File_Inclusion
https://github.com/wagnerdracha/ProofOfConcept/blob/main/i3geo_proof_of_concept.txt