External risk intelligence

ESPCMS UPFILE_PIC_ZOOM_HIGHT Remote Code Execution Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2022-44087

ESPCMS is a content management system designed to host websites. As a web application, it is typically deployed as a public-facing service to serve web content, making its components, such as file upload functionality, commonly reachable over the internet.

Code Injection

Ecisp Espcms

p8.21120101

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in ESPCMS allows unauthenticated remote code execution, meaning an attacker could potentially take control of systems running this content management software without needing any prior access or credentials. This could have broad implications for any organization using ESPCMS for their web presence.

Unauthenticated attackers can run code remotely.
This impacts web content management systems.
Confirm relevance and assess exposure risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit a remote code execution vulnerability within the UPFILE_PIC_ZOOM_HIGHT component of ESPCMS. This vulnerability is accessible over the network without requiring any prior authentication or user interaction. Successful exploitation could allow an attacker to gain complete control of the affected system, leading to severe data compromise and service disruption.

No authentication required for access.
Uploading a specially crafted image file triggers vulnerability.
Complete system compromise leading to RCE.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in ESPCMS's file upload component could allow an unauthenticated attacker to execute arbitrary code on the server. This could occur when the vulnerable component is accessible over the network and is triggered by a specially crafted request.

Server code execution.
Remote, unauthenticated access.
Compromise of server integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical remote code execution vulnerability in ESPCMS likely impacts organizations hosting public-facing websites managed by content management systems. The first practical move is to identify all instances of ESPCMS, confirm their internet reachability and business criticality, and then assign ownership for remediation planning.

Application owners should manage remediation.
Verify ESPCMS internet exposure first.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is ESPCMS?

ESPCMS is a content management system used to build and manage websites. It provides the underlying infrastructure for hosting web content, which typically involves server-side components that handle user interactions and file processing.

What does CWE-94 mean for CVE-2022-44087?

CWE-94 refers to Improper Control of Generation of Code. In the context of this CVE, it means the application fails to properly sanitize or validate input within the UPFILE_PIC_ZOOM_HIGHT component, inadvertently allowing an attacker to inject and execute their own code on the server.

How is this RCE vulnerability triggered?

The vulnerability is triggered when an attacker sends a specially crafted image file to the UPFILE_PIC_ZOOM_HIGHT component. It does not require any prior authentication or special user privileges to initiate. Simply interacting with the vulnerable upload function with a malicious file is sufficient to execute the code.

Why should I care if my ESPCMS instance is internet-facing?

Halo Surface Signal notes that because ESPCMS is a web application designed to serve public content, it is often deployed in a way that is reachable over the internet. If your instance is exposed, an attacker can access the vulnerable component remotely from anywhere, significantly increasing the likelihood of an attempt to take control of your system.

Do I need to take immediate action if I run ESPCMS?

Yes. Start by creating an inventory of all instances running in your environment. Prioritize those that are accessible via the internet, as these represent the highest risk. Work with your IT or security team to verify if you are using the affected version and prepare a remediation plan to secure or update the software.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.