CVE-2022-51019— Akaunting before 2.1.31 OS Command Injection via app alias

Quick assessment

Copy summary Copy citation

Affected

akaunting akaunting

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command execution. Authenticated users with admin panel access can inject shell metachara

CVE-2022-51019 affects akaunting akaunting. No confirmed in-the-wild exploitation; assess based on exposure. Akaunting before 2.1.31 contains an OS command injection vulnerability in the module installation and update flow where the alias parameter is passed unvalidated to shell command e CVE-2022-51019 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2022-51019

I. Basic Information for CVE-2022-51019

Affected Products

II. Public POCs for CVE-2022-51019

III. Intelligence Information for CVE-2022-51019

Other References for CVE-2022-51019 (5)

• https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/FinishUpdate.php#L45-L47 technical-description
• https://github.com/akaunting/akaunting/blob/2.1.30/app/Jobs/Install/InstallModule.php#L37-L39 technical-description
• https://github.com/akaunting/akaunting/commit/a1792327347a56ea575240b58673b2ece44230da patch
• https://github.com/akaunting/akaunting/releases/tag/2.1.31 release-notes
• https://www.vulncheck.com/advisories/akaunting-before-2.1.31-os-command-injection-via-app-alias third-party-advisory

• https://www.cve.org/CVERecord?id=CVE-2022-51019

IV. Related Vulnerabilities

V. Comments for CVE-2022-51019