CVE-2021-39433

HIGHNuclei

BIQS IT Biqs-drive v1.83 Local File Inclusion

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2021-39433 has a selected CVSS score of 7.5 (high); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

A local file inclusion (LFI) vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1
Nuclei templates
1

Proofs of concept

1

Repository PoCs

GitHubPinkDraconian/CVE-2021-39433Repository PoCby PinkDraconian5Not analyzed1 file

390 B

GitHub
PoC details

Nuclei templates

1
ProjectDiscoveryHIGHBIQS IT Biqs-drive v1.83 Local File InclusionCVSS 7.5

A local file inclusion vulnerability exists in version BIQS IT Biqs-drive v1.83 and below when sending a specific payload as the file parameter to download/index.php. This allows the attacker to read arbitrary files from the server with the permissions of the configured web-user.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to sensitive files, remote code execution, and potential compromise of the entire system.

Remediation

Upgrade to the latest version of BIQS IT Biqs-drive (v1.84 or higher) which includes a fix for the Local File Inclusion vulnerability.

AuthorsVeshraj
Template tagscve2021cvelfibiqsdrivebiqsvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CPE: cpe:2.3:a:biqs:biqsdrive:*:*:*:*:*:*:*:*
https://github.com/PinkDraconian/CVE-2021-39433/blob/main/README.md https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-39433 https://biqs-drive.be/ https://github.com/ARPSyndicate/cvemon https://github.com/ARPSyndicate/kenzer-templates

Source: ProjectDiscovery

References

3