PT-2021-15883 · WordPress · Sp Project & Document Manager

Viktor Markopoulos · Published 2021-06-14 · Updated 2022-11-09 · CVE-2021-24347

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The SP Project & Document Manager WordPress plugin versions prior to 4.22

Description The issue allows users to upload files, but the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. However, it was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".

Recommendations For versions prior to 4.22, update to version 4.22 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to prevent potential exploitation until the update is applied.

Exploit

Fix

Weakness Enumeration

CWE-178

Related Identifiers

CVE-2021-24347

Affected Products

Sp Project & Document Manager

References · 9

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/wp_plugin_sp_project_document_rce.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html · Exploit
• 🔥 http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html · Exploit
• 🔥 https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24347 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24347 · Vendor Advisory
• https://t.me/cvenotify/37345 · Telegram Post
• https://t.me/cvenotify/16247 · Telegram Post
• https://t.me/cvenotify/17276 · Telegram Post