CVE-2022-43351 is a vulnerability identified in Sanitization Management System version 1.0, involving an arbitrary file deletion flaw. The vulnerability exists in the component accessible via the endpoint /classes/Master.php?f=delete_img. This flaw allows an authenticated user with high privileges (as indicated by the CVSS vector requiring PR:H) to delete arbitrary files on the system without proper sanitization or validation of the file path parameter. The vulnerability does not require user interaction but does require authentication with elevated privileges, which limits exploitation to insiders or attackers who have already compromised credentials. The CVSS score of 6.5 (medium severity) reflects the significant impact on integrity and availability, as arbitrary file deletion can disrupt system operations or delete critical files, potentially causing denial of service or data loss. Confidentiality is not impacted directly. The vulnerability is remotely exploitable over the network (AV:N) and has low attack complexity (AC:L), meaning that once an attacker has the required privileges, exploitation is straightforward. There are no known public exploits in the wild, and no patches or vendor information is provided, indicating that organizations using this system may need to implement compensating controls or monitor for suspicious activity until a fix is available.

For European organizations using the Sanitization Management System v1.0, this vulnerability poses a risk primarily to system integrity and availability. Arbitrary file deletion could lead to disruption of sanitization management operations, potentially impacting compliance with hygiene or safety regulations, especially in healthcare, manufacturing, or public facilities. Loss of critical files could cause operational downtime, data loss, or require costly recovery efforts. Since exploitation requires high privilege authentication, the threat is heightened from insider threats or attackers who have gained elevated access through other means. This could also facilitate lateral movement or further compromise within the network. The lack of a vendor patch increases the risk exposure duration. Organizations in sectors with strict regulatory requirements or critical infrastructure roles may face increased operational and reputational risks if this vulnerability is exploited.

1. Restrict access to the Sanitization Management System to only trusted and necessary personnel, enforcing strict role-based access controls to minimize the number of users with high privileges. 2. Monitor and audit all file deletion requests and related activities on the system to detect anomalous or unauthorized deletion attempts. 3. Implement network segmentation and isolation for the system to limit exposure to potential attackers. 4. Employ application-layer firewalls or web application firewalls (WAFs) to detect and block suspicious requests targeting the vulnerable endpoint. 5. Regularly back up critical files and system configurations to enable rapid recovery in case of file deletion. 6. If possible, conduct a code review or implement input validation and sanitization on the affected endpoint to prevent arbitrary file path manipulation. 7. Engage with the vendor or community to obtain patches or updates addressing this vulnerability and apply them promptly once available. 8. Educate privileged users about the risks and enforce strong authentication mechanisms, such as multi-factor authentication, to reduce the risk of credential compromise.