CVE-2023-53922
CRITICALTinyWebGallery 2.5 - Unauthenticated Remote Code Execution via Malicious PHAR File Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-53922. PoCs published by Mirabbas Ağalarov.
AI-analyzed exploit summary This exploit demonstrates a file upload vulnerability in TinyWebGallery v2.5, allowing an attacker to upload a malicious .phar file containing PHP code for remote command execution. The PoC includes a multipart/form-data request to bypass restrictions and execute arbitrary commands.
Description
TinyWebGallery v2.5 contains a remote code execution vulnerability in the admin upload functionality that allows unauthenticated attackers to upload malicious PHP files. Attackers can upload .phar files with embedded system commands to execute arbitrary code on the server by accessing the uploaded file's URL.
Exploits (1)
This exploit demonstrates a file upload vulnerability in TinyWebGallery v2.5, allowing an attacker to upload a malicious .phar file containing PHP code for remote command execution. The PoC includes a multipart/form-data request to bypass restrictions and execute arbitrary commands.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H