CVE-2021-36622

· CRITICALModified

← All CVEs

CVSS v3.1

9.8

EPSS

1.87%

Published

Aug 3, 2021

Modified

Nov 21, 2024

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

Sourcecodester Online Covid Vaccination Scheduler System 1.0 is affected vulnerable to Arbitrary File Upload. The admin panel has an upload function of profile photo accessible at http://localhost/scheduler/admin/?page=user. An attacker could upload a malicious file such as shell.php with the Content-Type: image/png. Then, the attacker have to visit the uploaded profile photo to access the shell.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-434

Affected Products (1)

online_covid_vaccination_scheduler_system_project · online_covid_vaccination_scheduler_systemvulnerable

References (2)

https://www.exploit-db.com/exploits/50114

ExploitThird Party AdvisoryVDB Entry

https://www.exploit-db.com/exploits/50114

ExploitThird Party AdvisoryVDB Entry

KEV Catalog EPSS Scores Vendors All CVEs