CVE-2023-27842
HIGHeXtplorer 2.1.15 - Remote Code Execution via Insecure Permissions in index.php
Title source: llmExploitation Summary
EIP tracks 3 public exploits for CVE-2023-27842. PoCs published by cowsecurity, tristao-io.
AI-analyzed exploit summary This repository contains a functional exploit for CVE-2023-27842, targeting eXtplorer 2.1.15. The exploit authenticates to a Joomla-based website with eXtplorer installed, uploads a PHP webshell, and executes arbitrary commands.
Description
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via the index.php compenent
Exploits (3)
This repository contains a functional exploit for CVE-2023-27842, targeting eXtplorer 2.1.15. The exploit authenticates to a Joomla-based website with eXtplorer installed, uploads a PHP webshell, and executes arbitrary commands.
This PoC demonstrates an authenticated remote code execution (RCE) vulnerability in eXtplorer 2.1.15 by exploiting insecure file permissions to modify the index.php file and inject malicious PHP code.
This PoC demonstrates an authenticated remote code execution (RCE) vulnerability in eXtplorer 2.1.15 by leveraging insecure file permissions to modify the index.php file and inject malicious PHP code. The attacker can then execute arbitrary system commands via a crafted GET parameter.
References (5)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H