PT-2021-21626 · Unknown · Online Student Admission System

Published 2021-10-26 · Updated 2021-10-28 · CVE-2021-37372

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Online Student Admission System version 1.0

Description The issue allows a low privileged user to upload malicious PHP files by updating their profile image, potentially leading to remote code execution.

Recommendations For Online Student Admission System version 1.0, consider disabling the profile image upload feature until a patch is available to prevent exploitation. Restrict access to the file upload module to minimize the risk of malicious file uploads. Avoid using the file upload functionality in the affected system until the issue is resolved.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-37372

Affected Products

Online Student Admission System

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-37372 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37372 · Vendor Advisory
• https://t.me/cibsecurity/31212 · Telegram Post
• http://packetstormsecurity.com/files/164625/Online-Student-Admission-System-1.0-SQL-Injection-Shell-Upload.html · Note
• https://sourcecodester.com/php/14874/online-student-admission-system.html · Note
• https://packetstormsecurity.com/files/164625/Online_Admission_System_CVEs-Gerard-Carbonell.pdf · Note