PT-2022-12556 · Unknown · Sourcecodester Vehicle Service Management System

P.L. Sanu · Published 2022-01-06 · Updated 2022-01-12 · CVE-2021-46079

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sourcecodester Vehicle Service Management System version 1.0

Description An Unrestricted File Upload issue exists, allowing a remote attacker to upload malicious files, which can lead to Html Injection.

Recommendations For Sourcecodester Vehicle Service Management System version 1.0, consider restricting file uploads to only necessary and validated files to minimize the risk of exploitation. As a temporary workaround, restrict access to file upload functionality until a proper fix is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-46079

Affected Products

Sourcecodester Vehicle Service Management System

References · 6

• 🔥 https://plsanu.com/vehicle-service-management-system-multiple-file-upload-leads-to-html-injection · Exploit
• 🔥 https://github.com/plsanu/Vehicle-Service-Management-System-Multiple-File-upload-Leads-to-Html-Injection · Exploit
• https://osv.dev/vulnerability/CVE-2021-46079 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-46079 · Security Note
• https://t.me/cibsecurity/35055 · Telegram Post
• https://t.me/cvenotify/25305 · Telegram Post