CVE-2021-27513
HIGHEyesOfNetwork 5.3-10 - Authenticated Unrestricted Upload of Dangerous File Type
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2021-27513. PoCs published by ArianeBlow.
AI-analyzed exploit summary This PoC exploits CVE-2021-27513 and CVE-2021-27514 in EyesOfNetwork (versions 5.3-5.3.10) by brute-forcing session IDs to bypass authentication, then uploading a malicious PHP file to achieve remote code execution (RCE) via a reverse shell.
Description
The module admin_ITSM in EyesOfNetwork 5.3-10 allows remote authenticated users to upload arbitrary .xml.php files because it relies on "le filtre userside."
Exploits (2)
This PoC exploits CVE-2021-27513 and CVE-2021-27514 in EyesOfNetwork (versions 5.3-5.3.10) by brute-forcing session IDs to bypass authentication, then uploading a malicious PHP file to achieve remote code execution (RCE) via a reverse shell.
This exploit leverages an arbitrary file upload vulnerability in EyesOfNetwork 5.3-10 to achieve remote code execution (RCE) via a malicious PHP file. It authenticates, uploads a reverse shell payload, and triggers it to establish a connection back to the attacker.
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H