CVE-2023-53942
HIGHFile Thingie 2.5.7 - Authenticated Arbitrary File Upload via PHP Zip Archive
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-53942. PoCs published by Maurice Fielenbach.
AI-analyzed exploit summary This exploit targets File Thingie 2.5.7, leveraging arbitrary file upload to achieve remote code execution (RCE) via a PHP webshell. It authenticates, creates a folder, uploads a malicious ZIP file, unzips it, and executes a reverse shell command.
Description
File Thingie 2.5.7 contains an authenticated file upload vulnerability that allows remote attackers to upload malicious PHP zip archives to the web server. Attackers can create a custom PHP payload, upload and unzip it, and then execute arbitrary system commands through a crafted PHP script with a command parameter.
Exploits (1)
This exploit targets File Thingie 2.5.7, leveraging arbitrary file upload to achieve remote code execution (RCE) via a PHP webshell. It authenticates, creates a folder, uploads a malicious ZIP file, unzips it, and executes a reverse shell command.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H