CVE-2021-47978
MEDIUMProcessMaker 3.5.4 Local File Inclusion via Path Traversal
Title source: cnaExploitation Summary
EIP tracks 1 public exploit for CVE-2021-47978. PoCs published by Ai Ho.
AI-analyzed exploit summary The exploit demonstrates a Local File Inclusion (LFI) vulnerability in ProcessMaker <= 3.5.4 by using path traversal sequences to access sensitive files like /etc/passwd. The provided curl command and Jaeles scanner signature confirm the vulnerability's exploitability.
Description
ProcessMaker 3.5.4 contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by exploiting improper path traversal validation. Attackers can send requests with directory traversal sequences to access sensitive system files like /etc/passwd without authentication.
Exploits (1)
The exploit demonstrates a Local File Inclusion (LFI) vulnerability in ProcessMaker <= 3.5.4 by using path traversal sequences to access sensitive files like /etc/passwd. The provided curl command and Jaeles scanner signature confirm the vulnerability's exploitability.
References (3)
Scores
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N