CVE-2024-58282
HIGHSerendipity 2.5.0 - Authenticated Remote Code Execution via Media Upload
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2024-58282. PoCs published by Ahmet Ümit BAYRAM.
AI-analyzed exploit summary This exploit demonstrates a Remote Code Execution (RCE) vulnerability in Serendipity 2.5.0 by leveraging an authenticated file upload flaw. It logs in as an admin, uploads a malicious PHP shell disguised as a media file, and provides a web interface for command execution.
Description
Serendipity 2.5.0 contains a remote code execution vulnerability that allows authenticated administrators to upload malicious PHP files through the media upload functionality. Attackers can exploit the file upload mechanism by creating a PHP shell with a command execution form that enables arbitrary system command execution on the web server.
Exploits (1)
This exploit demonstrates a Remote Code Execution (RCE) vulnerability in Serendipity 2.5.0 by leveraging an authenticated file upload flaw. It logs in as an admin, uploads a malicious PHP shell disguised as a media file, and provides a web interface for command execution.
References (4)
Scores
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H