CVE-2022-40777 in Email Marketer
Summary
by MITRE • 10/12/2022
Interspire Email Marketer through 6.5.0 allows arbitrary file upload via a surveys_submit.php "create survey and submit survey" operation, which can cause a .php file to be accessible under a /admin/temp/surveys/ URI. NOTE: this issue exists because of an incomplete fix for CVE-2018-19550.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability CVE-2022-40777 represents a critical arbitrary file upload flaw in Interspire Email Marketer versions up to 6.5.0, specifically affecting the surveys_submit.php component during "create survey and submit survey" operations. This vulnerability allows attackers to upload malicious PHP files to the server, which can then be executed under the web server's privileges. The flaw manifests when uploaded files are stored in the /admin/temp/surveys/ directory, making them directly accessible via URI access. The issue is particularly concerning as it builds upon an existing vulnerability CVE-2018-19550, indicating a persistent security gap in the application's file handling mechanisms that was inadequately addressed in previous patches. This represents a classic example of incomplete remediation where the original fix failed to fully address all attack vectors within the application's codebase.
The technical exploitation of this vulnerability involves leveraging the application's survey submission functionality to upload a malicious file with a .php extension through the surveys_submit.php endpoint. When the upload occurs, the application fails to properly validate or sanitize the uploaded file's content and extension, allowing PHP code to be stored and executed on the server. The uploaded files are placed in the /admin/temp/surveys/ directory, which is accessible through the web server, creating a direct path for remote code execution. This vulnerability falls under CWE-434 Unrestricted Upload of File with Dangerous Type, which is classified as a high-risk issue in the Common Weakness Enumeration catalog. The flaw demonstrates poor input validation and inadequate file type checking mechanisms, typical of insecure programming practices that allow attackers to bypass security controls through insufficient validation of user-supplied data.
The operational impact of this vulnerability is severe and far-reaching for organizations using affected versions of Interspire Email Marketer. Successful exploitation can lead to complete system compromise, allowing attackers to execute arbitrary code, escalate privileges, and potentially gain access to sensitive data stored within the email marketing platform. The vulnerability enables attackers to deploy web shells, malware, or other malicious payloads that can persist on the system and provide ongoing access. Organizations may face data breaches, unauthorized access to customer information, and potential regulatory compliance violations. The presence of this vulnerability in a widely used email marketing platform increases the attack surface for organizations that rely on Interspire, particularly those managing large volumes of customer data. The fact that this issue stems from an incomplete fix for CVE-2018-19550 suggests that organizations may have already been compromised by the original vulnerability, potentially leaving backdoors or persistent malware on their systems.
Organizations should immediately implement multiple layers of mitigation to address this vulnerability. The primary recommendation is to upgrade to the latest version of Interspire Email Marketer where this vulnerability has been properly patched. In the interim, administrators should implement strict file type validation and content checking on the surveys_submit.php endpoint, ensuring that only approved file types are accepted and that uploaded files are scanned for malicious content. Network-level mitigations such as web application firewalls should be deployed to block suspicious file upload attempts and monitor for patterns associated with this specific vulnerability. Additionally, the affected directories should be secured with proper access controls, and file permissions should be restricted to prevent execution of uploaded files. The vulnerability aligns with ATT&CK technique T1190 Exploit Public-Facing Application, which emphasizes the importance of securing web applications against file upload vulnerabilities that can lead to remote code execution. Security monitoring should be enhanced to detect unauthorized file uploads and suspicious activity in the /admin/temp/surveys/ directory, as this represents a critical attack vector that could lead to complete system compromise.