CVE-2021-42669: Malicious File Upload
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboardteacher.php, which allows changing the avatar through teacheravatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing "<?php system($GET["cmd"]); ?>" the attacker can execute commands on the web server with - /admin/uploads/php-webshell?cmd=id.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-42669?
CVE-2021-42669 is a file upload vulnerability that exists in the Sourcecodester Engineers Online Portal in PHP.
How does CVE-2021-42669 work?
CVE-2021-42669 allows an attacker to change the avatar through teacher_avatar.php, which results in the uploaded file being accessible by all users.
What is the severity of CVE-2021-42669?
CVE-2021-42669 has a severity rating of 9.8, which is classified as critical.
What software is affected by CVE-2021-42669?
Engineers Online Portal Project Engineers Online Portal version is affected by CVE-2021-42669.
How can I fix CVE-2021-42669?
To fix CVE-2021-42669, you should update the Sourcecodester Engineers Online Portal to a patched version provided by the vendor.