CVE-2023-54335
CRITICALeXtplorer < 2.1.14 - Unauthenticated Authentication Bypass and Remote Code Execution
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2023-54335. PoCs published by ErPaciocco.
AI-analyzed exploit summary This exploit demonstrates an authentication bypass vulnerability in eXtplorer <= 2.1.14 by omitting the password field in a POST request, followed by a file upload leading to remote code execution. The script automates the process of detecting the vulnerability, bypassing authentication, and uploading a malicious PHP file.
Description
eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. Attackers can exploit this flaw to upload malicious PHP files and execute remote commands on the vulnerable file management system.
Exploits (1)
This exploit demonstrates an authentication bypass vulnerability in eXtplorer <= 2.1.14 by omitting the password field in a POST request, followed by a file upload leading to remote code execution. The script automates the process of detecting the vulnerability, bypassing authentication, and uploading a malicious PHP file.
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H