CVE-2014-9567
ProjectSend r100-r561 - Unauthenticated Arbitrary File Upload and Remote Code Execution via process-upload.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2014-9567.
PoCs published by Metasploit, Fady Mohammed Osman, Fady Mohammed Osman, bcoles, including Metasploit module exploits/unix/webapp/projectsend_upload_exec.
AI-analyzed exploit summary This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in ProjectSend (revisions 100-561) via 'process-upload.php', allowing remote code execution as the web server user.
Description
Unrestricted file upload vulnerability in process-upload.php in ProjectSend (formerly cFTP) r100 through r561 allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension, then accessing it via a direct request to the file in the upload/files/ or upload/temp/ directory.
Exploits (3)
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in ProjectSend (revisions 100-561) via 'process-upload.php', allowing remote code execution as the web server user.
This exploit leverages an arbitrary file upload vulnerability in ProjectSend r-561 by bypassing file extension restrictions via the 'name' parameter in the upload request. It allows an attacker to upload a malicious file (e.g., a PHP shell) to achieve remote code execution.
This Metasploit module exploits an unauthenticated arbitrary file upload vulnerability in ProjectSend (CVE-2014-9567) by uploading a PHP payload via 'process-upload.php' and executing it to achieve remote code execution as the web server user.