CVE-2021-25003
CRITICAL EXPLOITED IN THE WILD NUCLEIWPCargo Track & Trace < 6.9.0 - Unauthenticated Arbitrary File Write and Remote Code Execution
Title source: llmExploitation Summary
CVE-2021-25003 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 1 public exploit from researchers including biulove0x. A Nuclei detection template is also available.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2021-25003, an unauthenticated RCE vulnerability in WPCargo < 6.9.0. The exploit leverages a PNG compression technique to inject malicious PHP code into a file, achieving remote command execution.
Description
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE
Exploits (1)
This repository contains a functional exploit for CVE-2021-25003, an unauthenticated RCE vulnerability in WPCargo < 6.9.0. The exploit leverages a PNG compression technique to inject malicious PHP code into a file, achieving remote command execution.
Nuclei Templates (1)
References (1)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H