.. / CVE-2021-4436

• File Upload
• Nuclei
• Web

Exploit for 3DPrint Lite < 1.9.1.5 - Arbitrary File Upload (CVE-2021-4436)

Description:

The plugin does not have any authorisation and does not check the uploaded file in its p3dlite_handle_upload AJAX action , allowing unauthenticated users to upload arbitrary file to the web server. However, there is a .htaccess, preventing the file to be accessed on Web servers such as Apache.

Nuclei Template

View the template here CVE-2021-4436.yaml

Validate with Nuclei

echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2021/CVE-2021-4436.yaml

References: