Vulnerability · Published Mar 15, 2022 · Assigned by mitre
CVE-2021-45010
High 8.8
In plain English
A high-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 70.1% (higher than 99.4% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS NVD)8.8High
Exploit odds (30 days)70.1%top 0.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Public PoC
Official description
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
Affected products (as reported)
References
- https://github.com/prasathmani/tinyfilemanager/pull/636 x_refsource_MISC
- https://github.com/prasathmani/tinyfilemanager/commit/2046bbde72ed76af0cfdcae082de629bcc4b44c7 x_refsource_MISC
- https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/ x_refsource_MISC
- https://github.com/febinrev/tinyfilemanager-2.4.3-exploit/raw/main/exploit.sh x_refsource_MISC
- https://sploitus.com/exploit?id=1337DAY-ID-37364&utm_source=rss&utm_medium=rss x_refsource_MISC
- https://raw.githubusercontent.com/febinrev/tinyfilemanager-2.4.6-exploit/main/exploit.sh x_refsource_MISC
- https://github.com/prasathmani/tinyfilemanager/pull/636/files/a93fc321a3c89fdb9bee860bf6df5d89083298d1 x_refsource_MISC
- http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html x_refsource_MISC