CVE-2021-45010
HIGHTiny File Manager < 2.4.7 - Authenticated Path Traversal and Remote Code Execution via File Upload
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2021-45010. PoCs published by FEBIN MON SAJI, BKreisel, Syd-SydneyJr.
AI-analyzed exploit summary This exploit targets Tiny File Manager <= 2.4.6, leveraging an authenticated RCE vulnerability (CVE-2021-40964) by uploading a malicious PHP shell via path traversal. It includes steps for authentication, webroot discovery, and shell execution.
Description
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
Exploits (4)
This exploit targets Tiny File Manager <= 2.4.6, leveraging an authenticated RCE vulnerability (CVE-2021-40964) by uploading a malicious PHP shell via path traversal. It includes steps for authentication, webroot discovery, and shell execution.
This is a functional Python-based exploit for CVE-2021-45010, targeting Tiny File Manager versions below 2.4.7. It leverages a directory traversal vulnerability to upload a PHP webshell, enabling remote command execution.
This is a functional exploit for CVE-2021-45010, targeting Tiny File Manager <= 2.4.3. It authenticates, uploads a PHP shell, and provides interactive command execution via a reverse shell mechanism.
This repository contains a functional Python exploit for CVE-2021-45010, which leverages a Local File Inclusion (LFI) vulnerability in Tiny File Manager before 2.4.7 to achieve Remote Code Execution (RCE). The exploit authenticates, uploads a malicious PHP file via path traversal, and executes arbitrary commands.
References (8)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H