CVE-2021-24347: vulnerability in SP Project & Document Manager
SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
30Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 54%
from disclosure to weaponsame day
Published on NVDJun 14
metasploitJun 14
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Affected products
Unknown · SP Project & Document ManagerRelated CVEs — SP Project & Document Manager
In the same product, most dangerous first.
CVE-2021-4225—SP Project & Document Manager < 4.24 - Subscriber+ Shell UploadEPSS 1.7%CVE-2022-1551—SP Project & Document Manager < 4.58 - Sensitive File DisclosureEPSS 1.0%CVE-2024-3749MEDIUMSP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOREPSS 0.5%CVE-2024-3748MEDIUMSP Project & Document Manager <= 4.71 - Data Update via IDOREPSS 0.4%