PT-2022-9782 · Maxboard · Maxboard

Published 2022-06-01 · Updated 2023-06-26 · CVE-2021-26634

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Maxboard (affected versions not specified)

Description The issue allows for SQL injection and file upload attacks due to insufficient validation of input values in some parameters and variables of files, which may lead to arbitrary code execution or privilege escalation. Attackers can use these vulnerabilities to perform attacks such as stealing server management rights using a web shell.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Authentication Bypass Using an Alternate Path or Channel

Unrestricted File Upload

SQL injection

Weakness Enumeration

CWE-288

CWE-434

CWE-89

Related Identifiers

CVE-2021-26634

Affected Products

Maxboard

References · 4

• https://osv.dev/vulnerability/CVE-2021-26634 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-26634 · Security Note
• https://t.me/cvenotify/31005 · Telegram Post
• https://krcert.or.kr/krcert/secNoticeView.do?bulletin_writing_sequence=66746 · Note