{"vulnerability": "CVE-2022-44384", "sightings": [{"uuid": "683e4786-2502-4c48-b76f-8202498f5738", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44384", "type": "seen", "source": "MISP/a9d21043-f825-4bac-8d2b-56fb9e8343e7", "content": "", "creation_timestamp": "2025-10-23T21:13:00.000000Z"}, {"uuid": "2c2ab3c5-0cbc-4439-916b-2a3379bf98cd", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44384", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/rconfig_vendors_auth_file_upload_rce.rb", "content": "", "creation_timestamp": "2021-06-24T15:51:21.000000Z"}, {"uuid": "f15a3882-c9a5-4815-bb4c-be332c66a29d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44384", "type": "published-proof-of-concept", "source": "https://t.me/DarkWebInformer_CVEAlerts/13838", "content": "\ud83d\udd17 DarkWebInformer.com - Cyber Threat Intelligence\n\ud83d\udccc CVE ID: CVE-2022-44384\n\ud83d\udd25 CVSS Score: N/A\n\ud83d\udd39 Description: An arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.\n\ud83d\udccf Published: 2022-11-17T00:00:00.000Z\n\ud83d\udccf Modified: 2025-04-29T14:53:39.852Z\n\ud83d\udd17 References:\n1. https://www.exploit-db.com/exploits/49783", "creation_timestamp": "2025-04-29T15:11:46.000000Z"}, {"uuid": "bc0135bc-13bb-48be-96a1-3c819b316724", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44384", "type": "seen", "source": "https://t.me/cibsecurity/53083", "content": "\u203c CVE-2022-44384 \u203c\n\nAn arbitrary file upload vulnerability in rconfig v3.9.6 allows attackers to execute arbitrary code via a crafted PHP file.\n\n\ud83d\udcd6 Read\n\nvia \"National Vulnerability Database\".", "creation_timestamp": "2022-11-17T20:18:08.000000Z"}, {"uuid": "76f8ce78-eb47-4bea-98eb-54333f4cf229", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2022-44384", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/rconfig_vendors_auth_file_upload_rce.rb", "content": "{\"aliases\": [], \"arch\": \"php\", \"author\": [\"MURAT \\u015eEKER\", \"VISHWARAJ BHATTRAI\", \"Yann Castel (yann.castel \"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This module allows an attacker with a privileged rConfig account to start a reverse shell\\n          due to an arbitrary file upload vulnerability in `/lib/crud/vendors.crud.php`.\\n          Then, the uploaded payload can be triggered by a call to `images/vendor/.php`\", \"disclosure_date\": \"2021-03-17\", \"fullname\": \"exploit/linux/http/rconfig_vendors_auth_file_upload_rce\", \"is_install_path\": true, \"mod_time\": \"2025-10-06 17:15:11 +0000\", \"name\": \"rConfig Vendors Auth File Upload RCE\", \"needs_cleanup\": true, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"artifacts-on-disk\", \"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/rconfig_vendors_auth_file_upload_rce.rb\", \"platform\": \"PHP\", \"post_auth\": true, \"rank\": 600, \"ref_name\": \"linux/http/rconfig_vendors_auth_file_upload_rce\", \"references\": [\"CVE-2022-44384\", \"EDB-49665\", \"EDB-49783\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"rConfig <= 3.9.6\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:54.306875Z"}]}