Vulnerabilities > CVE-2022-27055 - Incorrect Authorization vulnerability in Ecjia Daojia 1.38.120210202629

047910
CVSS 7.5 - HIGH
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
network
low complexity
ecjia
CWE-863
NVD
Published: 2022-04-19
Updated: 2024-04-11

Summary

ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes this because the environment file is in the data directory, which is not intended for access by website visitors (only the statics directory can be accessed by website visitors)

Vulnerable Configurations

Part Description Count
Application
Ecjia
1

Common Weakness Enumeration (CWE)

References