PT-2021-21633 · Rpcms · Rpcms

Zhang Zhiyi · Published 2021-07-26 · Updated 2022-07-12 · CVE-2021-37394

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions RPCMS versions 1.8 and below

Description The issue allows attackers to interact with the API and change the role variable to admin, achieving admin user registration.

Recommendations For RPCMS versions 1.8 and below, as a temporary workaround, consider restricting access to the API endpoint that allows modification of the role variable until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Related Identifiers

CVE-2021-37394

Affected Products

Rpcms

References · 7

• 🔥 https://gist.github.com/victomteng1997/bfa1e0e07dd22f7e0b13256eda79626f · Exploit
• https://osv.dev/vulnerability/CVE-2021-37394 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37394 · Security Note
• https://t.me/cvenotify/18150 · Telegram Post
• https://github.com/ralap-z/RPCMS · Note
• https://t.me/cibsecurity/26507 · Telegram Post
• https://t.me/cvenotify/18794 · Telegram Post