PT-2021-3652 · Unknown · Qibosoftx1

Published 2021-05-21 · Updated 2021-06-03 · CVE-2021-27811

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions QibosoftX1 version 1.0

Description A code injection issue has been found in the Upgrade function, related to incorrect code generation management in components such as client upgrade edition.php and Upgrade.php. This allows an attacker to execute arbitrary PHP code.

Recommendations For QibosoftX1 version 1.0, consider disabling the Upgrade function temporarily until a patch is available to prevent exploitation. Restrict access to the client upgrade edition.php and Upgrade.php components to minimize the risk of arbitrary PHP code execution.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

BDU:2021-03871

CVE-2021-27811

Affected Products

Qibosoftx1

References · 8

• 🔥❌ https://github.com/whiskey-jj/w2s2x2222.github.io/issues/2 · Exploit, Deleted
• https://osv.dev/vulnerability/CVE-2021-27811 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-27811 · Security Note
• https://bdu.fstec.ru/vul/2021-03871 · Security Note
• https://cvedata.com/cve/CVE-2021-27811 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27811 · Note
• https://vuldb.com/de/?id.175475 · Note
• https://cnvd.org.cn/flaw/show/2297879 · Note