PT-2021-22296

CVE-2021-38841

·

Published

2021-09-07

·

Updated

2021-09-13

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Simple Water Refilling Station Management System version 1.0
Description The issue allows for Remote Code Execution via the System Logo option on the system info page in classes/SystemSettings.php with an update settings action.
Recommendations For Simple Water Refilling Station Management System version 1.0, consider restricting access to the system info page or disabling the update settings action in classes/SystemSettings.php to minimize the risk of exploitation.
Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2021-38841
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com