cbcvebase.
CVE-2021-42669
published 2021-11-05

CVE-2021-42669: A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through…

PriorityP267critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
23.27%
97.5th percentile
A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. Once an avatar gets uploaded it is getting uploaded to the /admin/uploads/ directory, and is accessible by all users. By uploading a php webshell containing "" the attacker can execute commands on the web server with - /admin/uploads/php-webshell?cmd=id.

Detection & IOCsextracted from sources · hover to see the quote

path/admin/uploads/↗
url/admin/uploads/php-webshell?cmd=id↗
pathteacher_avatar.php↗
pathdashboard_teacher.php↗
snort
alert http any any -> [$HOME_NET,$HTTP_SERVERS] any (msg:"ET EXPLOIT Possible Engineers Online Portal System Webshell Upload (CVE-2021-42669)"; flow:established,to_server; http.method; content:"POST"; http.uri; content:"teacher_avatar.php"; fast_pattern; http.request_body; content:"<?php"; reference:cve,2021-42669; classtype:attempted-admin; sid:2034453; rev:1; metadata:attack_target Server, created_at 2021_11_13, cve CVE_2021_42669, deployment Perimeter, deployment Internal, confidence Medium, signature_severity Major, tag Exploit, updated_at 2021_11_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application;)
  • →Detect POST requests to teacher_avatar.php containing PHP code (<?php) in the request body, indicating a webshell upload attempt. ↗
  • →Monitor for GET requests to /admin/uploads/ with a cmd= query parameter, indicating webshell execution attempts post-upload. ↗
  • →Alert on any PHP files appearing in the /admin/uploads/ directory, as this directory should not contain executable scripts. ↗
  • ·The ET rule targets both perimeter and internal deployments, meaning the upload vector may be exploitable from internal network segments as well as externally. ↗

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.