CVE-2021-32305
CRITICAL EXPLOITED IN THE WILD NUCLEIWebSVN < 2.6.1 - Remote Code Execution via Search Parameter
Title source: llmExploitation Summary
CVE-2021-32305 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io). EIP tracks 2 public exploits from researchers including g0ldm45k, FredBrave. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit targets an unauthenticated remote code execution vulnerability in Websvn 2.6.0 by injecting a command into the search parameter, which executes a reverse shell payload. The payload is URL-encoded and sent via a GET request to the vulnerable endpoint.
Description
WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.
Exploits (2)
This exploit targets an unauthenticated remote code execution vulnerability in Websvn 2.6.0 by injecting a command into the search parameter, which executes a reverse shell payload. The payload is URL-encoded and sent via a GET request to the vulnerable endpoint.
This repository contains a functional exploit for CVE-2021-32305, a command injection vulnerability in WebSVN 2.6.0. The exploit leverages an unauthenticated command injection flaw in the search.php endpoint by injecting a payload via the search parameter.
Nuclei Templates (1)
References (2)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H