.. / CVE-2021-24347

• File Upload
• Nuclei
• Web

Exploit for WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload (CVE-2021-24347)

Description:

WordPress SP Project & Document Manager plugin before 4.22 is susceptible to authenticated shell upload. The plugin allows users to upload files; however, the plugin attempts to prevent PHP and other similar executable files from being uploaded via checking the file extension. PHP files can still be uploaded by changing the file extension’s case, for example, from php to pHP.

Nuclei Template

View the template here CVE-2021-24347.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-24347.yaml

References: