CVE-2022-24664

EUVD-2022-29539 · Published Feb 16, 2022

PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via WordPress metaboxes, which could be used by any user able to edit posts.

Technologies

Php_Everywhere_Project Php Everywhere

Weaknesses

CWE-94

CVSS scores

v3.18.8CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
v2.04.0AV:N/AC:L/Au:S/C:N/I:P/A:N

MITRE ATT&CK

Inferred

Where this vulnerability fits in an attack

ReconImpact

Initial Access Stealth

T1190Exploit Public-Facing Application T1027.006HTML Smuggling T1027.009Embedded Payloads T1564.009Resource Forking

References

https://www.wordfence.com/blog/2022/02/critical-vulnerabilities-in-php-everywhere-allow-remote-code-execution/

Potentially impacted assets

See if this affects your attack surface