Exploitation Summary
EIP tracks 2 public exploits for CVE-2020-10963. PoCs published by Xavi Beltran, scopion.
AI-analyzed exploit summary This exploit leverages an unrestricted file upload vulnerability in Laravel Administrator 4 to upload a malicious PHP file disguised as a GIF, which executes a reverse shell when accessed. It requires authentication and targets the file upload functionality.
Description
FrozenNode Laravel-Administrator through 5.0.12 allows unrestricted file upload (and consequently Remote Code Execution) via admin/tips_image/image/file_upload image upload with PHP content within a GIF image that has the .php extension. NOTE: this product is discontinued.
Exploits (2)
This exploit leverages an unrestricted file upload vulnerability in Laravel Administrator 4 to upload a malicious PHP file disguised as a GIF, which executes a reverse shell when accessed. It requires authentication and targets the file upload functionality.
This exploit targets an unrestricted file upload vulnerability in Laravel Administrator 4, allowing authenticated users to upload a malicious PHP file disguised as an image. The payload executes a reverse shell upon access.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H