CVE-2022-47075

Published: Feb 28, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.

Affected (1)

Products: Smartofficepayroll: Smartoffice

Smartofficepayroll

1 product

Smartoffice

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Smartofficepayroll Smartoffice	version ≤ 20.28

References (8)

http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html

Source: cve@mitre.org

https://cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/

Source: cve@mitre.org

ExploitThird Party Advisory

https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/

Source: cve@mitre.org

Broken Link

https://youtu.be/D42upepxzwM

Source: cve@mitre.org

Permissions Required

http://packetstormsecurity.com/files/173093/Smart-Office-Web-20.28-Information-Disclosure-Insecure-Direct-Object-Reference.html

Source: af854a3a-2127-422b-91ae-364da2661108

https://cvewalkthrough.com/smart-office-suite-cve-2022-47076-cve-2022-47075/

Source: af854a3a-2127-422b-91ae-364da2661108

ExploitThird Party Advisory

https://cvewalkthrough.com/smart-office-suite-unauthenticated-data-ex/

Source: af854a3a-2127-422b-91ae-364da2661108

Broken Link

https://youtu.be/D42upepxzwM

Source: af854a3a-2127-422b-91ae-364da2661108

Permissions Required

Timeline

No history available yet.