mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-30 18:56:19 +00:00
18 lines
1.2 KiB
Markdown
18 lines
1.2 KiB
Markdown
|
### [CVE-2021-38346](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-38346)
|
||
|
|
|
||
|
|
|
||
|
|
&color=brightgreen)
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
No PoCs from references.
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/20142995/nuclei-templates
|
||
|
|
|