Open Web Analytics (OWA) before 1.7.4 allows an unauthenticated remote attacker to obtain sensitive user information, which can be used to gain admin privileges by leveraging cache hashes. This occurs because files generated with '<?php (instead of the intended "<?php sequence) aren't handled by the PHP interpreter.
PoC: CVE-2022-24637
Unauthenticated RCE in Open Web Analytics version <1.7.4
PoC: CVE-2022-24637
Unauthenticated RCE in Open Web Analytics (OWA) 1.7.3
PoC: CVE-2022-24637
Open Web Analytics 1.7.3 - Remote Code Execution Exploit v2
PoC: HTB-pwned
CVE-2022-24637
PoC: CVE-2022-24637
Open Web Analytics 1.7.3 - Remote Code Execution
PoC: CVE-2022-24637
FIxed exploit for CVE-2022-24637 (original xplt: https://www.exploit-db.com/exploits/51026)
PoC: CVE-2022-24637
Open Web Analytics (OWA) - Unauthenticated Remote Code Execution
PoC: CVE-2022-24637
Unauthicated RCE for open-web-analytics(1.7.3)
PoC: CVE-2022-24637
Unauthenticated RCE in Open Web Analytics (OWA) 1.7.3
PoC: cve-2022-24637_open-web-analytics-info-disclosure-to-rce
Based on https://devel0pment.de/?p=2494
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Get alerted for CVEs like this
Register your stack and get notified within minutes when a matching CVE drops.
Start monitoring free