PT-2022-12425 · Unknown · The Online Admission System

Longwayhomie · Published 2022-03-18 · Updated 2022-03-25 · CVE-2021-45835

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions The Online Admission System version 1.0

Description The issue allows an unauthenticated attacker to upload or transfer files of dangerous types to the application through the "documents.php" endpoint, which may be used to execute malicious code or lead to code execution.

Recommendations For The Online Admission System version 1.0, consider restricting access to the "documents.php" endpoint to prevent unauthenticated file uploads until a patch is available. As a temporary workaround, restrict the types of files that can be uploaded through this endpoint to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-45835

Affected Products

The Online Admission System

References · 6

• 🔥 https://exploit-db.com/exploits/50623 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-45835 · Security Note
• https://osv.dev/vulnerability/CVE-2021-45835 · Vendor Advisory
• https://github.com/rskoolrash/Online-Admission-System/issues/2 · Note
• https://github.com/rskoolrash/Online-Admission-System · Note
• https://t.me/cibsecurity/39195 · Telegram Post