CVE-2020-23934
HIGHRiteCMS 2.2.1 - Authenticated OS Command Execution via Filemanager PHP Upload
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2020-23934. PoCs published by Enes Özeser, H0j3n.
AI-analyzed exploit summary This exploit leverages an authenticated file upload vulnerability in RiteCMS 2.2.1 to achieve remote code execution by uploading a malicious PHP shell. The attacker can then execute arbitrary commands via HTTP requests to the uploaded file.
Description
An issue was discovered in RiteCMS 2.2.1. An authenticated user can directly execute system commands by uploading a php web shell in the "Filemanager" section.
Exploits (2)
This exploit leverages an authenticated file upload vulnerability in RiteCMS 2.2.1 to achieve remote code execution by uploading a malicious PHP shell. The attacker can then execute arbitrary commands via HTTP requests to the uploaded file.
This exploit targets CVE-2020-23934, an authenticated remote code execution vulnerability in RiteCMS v2.2.1. It uploads a malicious PHP file via the filemanager functionality, which executes a reverse shell payload upon access.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H