PT-2021-23370 · Sourcecodester · Sourcecodester E-Negosyo System

Nu11Secur1Ty · Published 2021-10-29 · Updated 2021-11-28 · CVE-2021-41675

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester E-Negosyo System version 1.0

Description A Remote Code Execution (RCE) issue exists in the system, specifically in the /admin/produts/controller.php file via the doInsert function. This function validates images using getImageSize.

Recommendations For Sourcecodester E-Negosyo System version 1.0, consider disabling the doInsert function in the /admin/produts/controller.php file as a temporary workaround until a patch is available. Restrict access to the vulnerable controller.php file to minimize the risk of exploitation. Avoid using the getImageSize function for image validation in the affected API endpoint until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-41675

Affected Products

Sourcecodester E-Negosyo System

References · 6

• 🔥 https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-41675 · Exploit
• 🔥 https://github.com/janikwehrli1/0dayHunt/blob/main/E-Negosyo-Authenticated-RCE.py · Exploit
• 🔥 https://nu11secur1ty.com/2021/11/cve-2021-41675.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-41675 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-41675 · Security Note
• https://t.me/cibsecurity/31469 · Telegram Post