PT-2021-10615 · Popojicms · Popojicms

Jinnywco · Published 2021-08-06 · Updated 2021-08-13 · CVE-2020-21356

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: PopojiCMS version 1.2

Description: An information disclosure issue in the upload.php file of PopojiCMS leads to the physical path disclosure of the host. This occurs when the name variable equals "file" and is deleted during file uploads, specifically through the "upload.php" endpoint.

Recommendations: For PopojiCMS version 1.2, as a temporary workaround, consider restricting access to the upload.php file until a patch is available. Avoid using the name variable with the value "file" in the upload process to minimize the risk of exploitation.

Exploit

Fix

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

Related Identifiers

CVE-2020-21356

Affected Products

Popojicms

References · 4

• 🔥 https://github.com/PopojiCMS/PopojiCMS/issues/23 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-21356 · Security Note
• https://osv.dev/vulnerability/CVE-2020-21356 · Vendor Advisory
• https://t.me/cvenotify/18819 · Telegram Post