Description
MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached through the administrative interface.
Advisories 1
- WID-SEC-2024-0524 Triumph-Adler aQrate: Schwachstelle ermöglicht Codeausführung BSI CERT-Bund (WID) · Feb 29, 2024
References
- https://docs.myq-solution.com/en/print-server/8.2/
- https://docs.myq-solution.com/en/print-server/8.2/technical-changelog#id-%288.2%29ReleaseNotes-8.2%28Patch43%29
- https://www.access42.nl/nieuws/unmasking-web-vulnerabilities-a-tale-of-default-admin-credentials-and-php-command-execution-cve-2024-22076/