Vulnerability · Published May 17, 2022 · Assigned by VulDB

CVE-2022-1753WoWonder Group requests.php access control

Medium 5.4

In plain English

A medium-severity improper access control in WoWonder from unspecified. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities).

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)0.9%top 39.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument group_id allows posting messages in other groups. It is possible to launch the attack remotely but it might require authentication. A video explaining the attack has been disclosed to the public.

Affected products (as reported)

Vendor	Product	Versions
unspecified	WoWonder	n/a

Weakness: CWE-284 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

References

https://youtu.be/tIzOZtp2fxA x_refsource_MISC
https://www.youtube.com/watch?v=tIzOZtp2fxA x_refsource_MISC
https://vuldb.com/?id.199974 x_refsource_MISC