CVE-2021-47964
HIGHSchlix CMS 2.2.6-6 Remote Code Execution via core.blockmanager
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47964. PoCs published by Eren Saraç.
AI-analyzed exploit summary This exploit demonstrates an authenticated RCE vulnerability in Schlix CMS 2.2.6-6 by leveraging the ability to upload a malicious ZIP file containing a modified 'packageinfo.inc' file with embedded PHP code. The code is executed when accessing the 'About' tab of the installed extension.
Description
Schlix CMS 2.2.6-6 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager. Attackers can upload a crafted ZIP file containing PHP code in the packageinfo.inc file and trigger execution by accessing the About tab of the installed extension.
Exploits (1)
This exploit demonstrates an authenticated RCE vulnerability in Schlix CMS 2.2.6-6 by leveraging the ability to upload a malicious ZIP file containing a modified 'packageinfo.inc' file with embedded PHP code. The code is executed when accessing the 'About' tab of the installed extension.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H