Exploitation Summary
EIP tracks 1 public exploit for CVE-2017-14704. PoCs published by Ihsan Sencan.
AI-analyzed exploit summary The exploit demonstrates an arbitrary file upload vulnerability in Claydip Laravel Airbnb Clone 1.0. The vulnerable endpoints allow uploading files with arbitrary extensions, including PHP, leading to potential remote code execution (RCE).
Description
Multiple unrestricted file upload vulnerabilities in the (1) imageSubmit and (2) proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in images/profile.
Exploits (1)
The exploit demonstrates an arbitrary file upload vulnerability in Claydip Laravel Airbnb Clone 1.0. The vulnerable endpoints allow uploading files with arbitrary extensions, including PHP, leading to potential remote code execution (RCE).
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H