cve/2022/CVE-2022-25297.md

CVE-2022-25297

Description

This affects the package drogonframework/drogon before 1.7.5. The unsafe handling of file names during upload using HttpFile::save() method may enable attackers to write files to arbitrary locations outside the designated target folder.

POC

Reference

• https://snyk.io/vuln/SNYK-UNMANAGED-DROGONFRAMEWORKDROGON-2407243

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/CVEDB/Poc-Git
• https://github.com/CVEDB/cve
• https://github.com/Kirill89/Kirill89
• https://github.com/SkyBelll/CVE-PoC
• https://github.com/jaeminLeee/cve
• https://github.com/trickest/cve
• https://github.com/w3security/PoCVE