CVE-2021-46013

An unrestricted file upload vulnerability exists in Sourcecodester Free school management software 1.0. An attacker can leverage this vulnerability to enable remote code execution on the affected web server. Once a php webshell containing "<?php system($_GET["cmd"]); ?>" gets uploaded it is saved into /uploads/exam_question/ directory, and is accessible by all users.

CVSS v3.1

9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

3.47% chance of exploitation in the next 30 days, 88th percentile

Published

2022-01-18

Updated

2024-08-04

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/50587

References

• CVE Record
• NVD entry

Related

• CVE-2021-46010
• CVE-2021-46019
• CVE-2021-46009
• CVE-2021-46020
• CVE-2021-46008
• CVE-2021-46021