CVE-2021-47783
MEDIUMphpwcms 1.9.30 - Authenticated Unrestricted Upload of Dangerous File via SVG File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47783. PoCs published by Okan Kurtulus.
AI-analyzed exploit summary This exploit demonstrates an arbitrary file upload vulnerability in Phpwcms 1.9.30 by uploading an SVG file containing JavaScript code. The exploit requires authentication and leverages a file upload feature to achieve XSS.
Description
Phpwcms 1.9.30 contains a file upload vulnerability that allows authenticated attackers to upload malicious SVG files with embedded JavaScript. Attackers can upload crafted SVG payloads through the multiple file upload feature to potentially execute cross-site scripting attacks on the platform.
Exploits (1)
This exploit demonstrates an arbitrary file upload vulnerability in Phpwcms 1.9.30 by uploading an SVG file containing JavaScript code. The exploit requires authentication and leverages a file upload feature to achieve XSS.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N