Exploitation Summary
EIP tracks 2 public exploits for CVE-2021-47904. PoCs published by Kr0ff, Metin Yunus Kandemir.
AI-analyzed exploit summary This exploit demonstrates an authenticated remote code execution vulnerability in PhreeBooks 5.2.3 via unrestricted file upload in the 'Image Manager' section. It uploads a PHP web shell to execute arbitrary commands on the target system.
Description
PhreeBooks 5.2.3 contains an authenticated file upload vulnerability in the Image Manager that allows remote code execution. Attackers can upload a malicious PHP web shell by exploiting unrestricted file type uploads to gain command execution on the server.
Exploits (2)
This exploit demonstrates an authenticated remote code execution vulnerability in PhreeBooks 5.2.3 via unrestricted file upload in the 'Image Manager' section. It uploads a PHP web shell to execute arbitrary commands on the target system.
This exploit demonstrates a remote command execution vulnerability in PhreeBooks ERP 5.2.3 by uploading a malicious PHP file through the Image Manager due to lack of file extension controls. It authenticates, uploads a reverse shell payload, and executes it to establish a connection to an attacker-controlled server.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H