.. / CVE-2022-47075

Exploit for Smart Office Web 20.28 - Information Disclosure (CVE-2022-47075)

Description:

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

Nuclei Template

View the template here CVE-2022-47075.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-47075.yaml
Copy

References:

https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/
http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html
https://nvd.nist.gov/vuln/detail/CVE-2022-47075
https://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html
https://youtu.be/D42upepxzwM