CVE-2021-39608

published 2021-08-23

CVE-2021-39608: Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php…

Priority P2 64 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

EXPLOIT

Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code.

Affected

1 ranges

Vendor	Product	Version range	Fixed in
flatcore	flatcore-cms	—	—

Detection & IOCs extracted from sources · hover to see the quote

path /acp/core/files.upload-script.php↗

path /upload/plugins/sgizoid.php↗

path /acp/acp.php?tn=addons↗

path /acp/acp.php?tn=moduls&sub=u&dir=plugins&del=sgizoid.php↗

cookie PHPSESSID↗

• → Monitor for GET requests to /upload/plugins/*.php, which indicates execution of a PHP webshell dropped via the plugin upload mechanism. ↗
• → The webshell uses the query parameter 'sg' to pass OS commands; detect GET requests to /upload/plugins/*.php containing a 'sg' query parameter as a strong indicator of active exploitation. ↗

• · Exploitation requires valid authenticated credentials to the FlatCore CMS admin panel; unauthenticated exploitation is not possible with this vulnerability. ↗
• · The exploit automatically deletes the dropped webshell after use, so forensic artifact (sgizoid.php in /upload/plugins/) may not persist; detection should focus on the upload event and execution requests rather than post-incident file presence. ↗

CVSS provenance

nvd v3.1 7.2 HIGH CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 9.0 CRITICAL AV:N/AC:L/Au:S/C:C/I:C/A:C

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434