Xerte Online Toolkits File Upload RCE via elfinder Connector
63Vexday Risk Score
Corrija em breve. Ela tem exploit funcional público.
ssvc Attendcvss 9.3epss 3.6%
da publicação à arma0 dias
Publicada no NVD22 de abr.
metasploit22 de abr.
probabilidade de exploração
3.6%top 12% das CVEs
exploração observada
nãonenhuma fonte reporta
1 exploit(s) público(s)
Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. Unauthenticated attackers can exploit this flaw combined with authentication bypass and path traversal vulnerabilities to upload malicious PHP code, rename it with a .php4 extension, and execute arbitrary operating system commands on the server.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Produtos afetados
thexerteproject · xerteonlinetoolkitsPoCs públicas encontradas — 1
cve_referencegithub.com/bootstrapbool/xerteonlinetoolkits-rcenão verificado⚠ Recursos públicos, para você avaliar a exposição de sistemas que controla ou está autorizado a testar. Teste apenas com autorização.
Referências
https://github.com/bootstrapbool/xerteonlinetoolkits-rcehttps://github.com/thexerteproject/xerteonlinetoolkits/commit/02661be88cc369325ea01b508086bde7fbfec805https://github.com/thexerteproject/xerteonlinetoolkits/commit/17e4f945fe6a3400fa88c01eda18c1075ee4a212https://github.com/thexerteproject/xerteonlinetoolkits/commit/507d55c5e91bf9310b5b1c7fad8aebfef902ad23https://github.com/thexerteproject/xerteonlinetoolkits/issues/1527https://www.vulncheck.com/advisories/xerte-online-toolkits-file-upload-rce-via-elfinder-connectorhttps://xerte.org.uk/index.php/en/downloads-1/category/3-xerte-online-toolkitshttps://xerte.org.uk/xertetoolkits_3.15_ChangeLog.html