CVE-2021-24347: fallo en SP Project & Document Manager
SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
30Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendepss 54%
de la publicación al armael mismo día
Publicada en NVD14 jun
metasploit14 jun
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
Productos afectados
Unknown · SP Project & Document ManagerCVEs relacionadas — SP Project & Document Manager
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-4225—SP Project & Document Manager < 4.24 - Subscriber+ Shell UploadEPSS 1.7%CVE-2022-1551—SP Project & Document Manager < 4.58 - Sensitive File DisclosureEPSS 1.0%CVE-2024-3749MEDIUMSP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOREPSS 0.5%CVE-2024-3748MEDIUMSP Project & Document Manager <= 4.71 - Data Update via IDOREPSS 0.4%