PT-2021-7954 · Wpanel 4 · Wpanel 4

Admin · Published 2021-06-05 · Updated 2022-04-08 · CVE-2021-34257

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions WPanel 4 versions 4.3.1 and below

Description The issue is related to the lack of restrictions on file uploads, allowing a remote attacker to execute arbitrary code by uploading a malicious PHP file. This can be done through various image upload features, including the Dashboard's Avatar image, Posts Folder image, Pages Folder image, and Gallery Folder image.

Recommendations For WPanel 4 versions 4.3.1 and below, consider disabling the image upload features for the Dashboard's Avatar, Posts Folder, Pages Folder, and Gallery Folder until a patch is available. Restrict access to these features to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2023-07225

CVE-2021-34257

GHSA-VHGR-GFX3-FG37

Affected Products

Wpanel 4

References · 9

• 🔥 https://latestpcsolution.wordpress.com/2021/06/05/wpanel4-cms-authenticated-rce · Exploit
• 🔥 https://github.com/Sentinal920/WPanel4-Authenticated-RCE · Exploit
• https://osv.dev/vulnerability/GHSA-vhgr-gfx3-fg37 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34257 · Security Note
• https://bdu.fstec.ru/vul/2023-07225 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34257 · Vendor Advisory
• https://github.com/wpanel/wpanel4-cms · Note
• https://t.me/cibsecurity/39924 · Telegram Post
• https://t.me/cvenotify/28217 · Telegram Post