CVE-2022-24984
Quick assessment
Affected
n/a n/a
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
JqueryForm.com Jquery Form Builder是JqueryForm.com公司的一个表单生成器。 JqueryForm.com Jquery Form Builder 存在代码问题漏洞，该漏洞源于JqueryForm.com 在 2022-02-05 之前生成的表单（如果启用了文件上传功能）允许远程未经身份验证的攻击者上传可执行文件并实现远程代码执行。 发生这种情况是因为文件扩展检查发生在客户端，并且并非所有可执行内容（例如，.phtml 或 .php.bak）都被阻止。
Possible ATT&CK Techniques 1 AI
T1505.003 · Web Shell
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-24984
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable files and achieve remote code execution. This occurs because file-extension checks occur on the client side, and because not all executable content (e.g., .phtml or .php.bak) is blocked.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
JqueryForm.com Jquery Form Builder 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
JqueryForm.com Jquery Form Builder是JqueryForm.com公司的一个表单生成器。 JqueryForm.com Jquery Form Builder 存在代码问题漏洞，该漏洞源于JqueryForm.com 在 2022-02-05 之前生成的表单（如果启用了文件上传功能）允许远程未经身份验证的攻击者上传可执行文件并实现远程代码执行。 发生这种情况是因为文件扩展检查发生在客户端，并且并非所有可执行内容（例如，.phtml 或 .php.bak）都被阻止。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | n/a | n/a | - |
|
II. Public POCs for CVE-2022-24984
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-24984
请登录查看更多情报信息。
Other References for CVE-2022-24984 (3)
-
https://JQueryForm.com x_refsource_MISC
-
https://gist.github.com/pb-nsi/4d0a1ede76d4e97083b3435f820bf560 x_refsource_MISC
-
https://www.nou-systems.com/cyber-security x_refsource_MISC
Same Patch Batch · n/a · 2022-02-16 · 50 CVEs total
| CVE-2021-23682 | 7.3 HIGH | Prototype Pollution |
| CVE-2022-22853 | Sourcecodester Hospital Patient Records Management System 跨站脚本漏洞 | |
| CVE-2021-3242 | DuxCMS 安全漏洞 | |
| CVE-2022-24983 | JqueryForm.com Jquery Form Builder 安全漏洞 | |
| CVE-2022-24985 | JqueryForm.com Jquery Form Builder 安全漏洞 | |
| CVE-2022-22880 | Jeecg-boot 安全漏洞 | |
| CVE-2022-22881 | Jeecg-Boot SQL注入漏洞 | |
| CVE-2022-22885 | Hutool 安全漏洞 | |
| CVE-2022-24982 | JqueryForm.com Jquery Form Builder 安全漏洞 | |
| CVE-2021-3773 | netfilter 信息泄露漏洞 | |
| CVE-2021-3760 | Linux kernel 资源管理错误漏洞 | |
| CVE-2021-3578 | Sourceforge mbsync 代码问题漏洞 | |
| CVE-2022-22945 | VMware NSX-T 操作系统命令注入漏洞 | |
| CVE-2022-23804 | KiCad Eda 缓冲区错误漏洞 | |
| CVE-2022-23803 | KiCad Eda 缓冲区错误漏洞 | |
| CVE-2021-21966 | Texas Instruments Cc3200 SimpleLink Solution Nwp 环境问题漏洞 | |
| CVE-2021-21958 | Hancom Office 缓冲区错误漏洞 | |
| CVE-2021-39300 | Hp Uefi 安全漏洞 | |
| CVE-2021-39299 | Hp Uefi 安全漏洞 | |
| CVE-2021-39301 | Hp Uefi 安全漏洞 |
Showing top 20 of 50 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
V. Comments for CVE-2022-24984
No comments yet