Tag
OpenMRS Module Upload Path Traversal Vulnerability
2 rules 1 TTPOpenMRS versions 2.7.8 and earlier, as well as versions 2.8.0 through 2.8.5, are vulnerable to a path traversal (Zip Slip) attack via the `POST /openmrs/ws/rest/v1/module` endpoint that allows authenticated attackers to achieve arbitrary file write and remote code execution.
CI4MS Backup Restore Zip Slip Vulnerability Leads to RCE
2 rules 2 TTPsThe CI4MS Backup restore function is vulnerable to Zip Slip, allowing remote code execution by uploading a malicious ZIP archive that writes PHP files to the public web root due to missing validation of entry names during extraction, affecting versions prior to 0.31.5.0.
Coder Code-Marketplace Zip Slip Vulnerability
2 rules 2 TTPsA Zip Slip vulnerability in coder/code-marketplace allows authenticated users to upload malicious VSIX files containing path traversal entries, leading to arbitrary file writes outside the extension directory and potentially enabling persistence.
SimpleHelp Path Traversal Vulnerability (CVE-2024-57728)
2 rules 3 TTPs 1 CVECVE-2024-57728 is a path traversal vulnerability in SimpleHelp that allows admin users to upload arbitrary files anywhere on the file system by uploading a crafted zip file, potentially leading to arbitrary code execution.
FacturaScripts Remote Code Execution via Zip Slip Vulnerability
2 rules 2 TTPsFacturaScripts is vulnerable to remote code execution due to insufficient validation of file paths within uploaded ZIP archives, allowing a Zip Slip attack and arbitrary file write leading to RCE.
CI4MS Theme Upload Zip Slip Vulnerability
2 rules 2 TTPsA critical vulnerability exists in ci4ms Theme::upload, where improper validation of ZIP archive entry names allows authenticated users with theme creation permissions to write files to arbitrary locations, leading to remote code execution.