cbcvebase.
CVE-2022-25485
published 2022-03-15

CVE-2022-25485: CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.

PriorityP272high7.8CVSS 3.1
AVLACLPRNUIRSUCHIHAH
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
7.93%
94.0th percentile
CuppaCMS v1.0 was discovered to contain a local file inclusion via the url parameter in /alerts/alertLightbox.php.

Affected

1 ranges
VendorProductVersion rangeFixed in
cuppacmscuppacms——

Detection & IOCsextracted from sources · hover to see the quote

path/alerts/alertLightbox.php↗
commandurl=../../../../../../../../../../../etc/passwd
  • →Detect POST requests to /alerts/alertLightbox.php with a 'url' parameter containing path traversal sequences (e.g., '../') targeting sensitive files such as /etc/passwd.
  • →A successful LFI exploitation response will return HTTP 200 and contain content matching the pattern 'root:[x*]:0:0' in the body.
  • ·The vulnerability is triggered via the POST body 'url' parameter, not a GET query string parameter — detection rules must inspect POST body content. ↗
  • ·CVSS score of 7.8 is rated with local attack vector (AV:L), but the Nuclei template demonstrates network-based exploitation via HTTP POST, suggesting the NVD vector may underrepresent real-world risk.

CVSS provenance

nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vulncheck7.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.