High severity · published Jun 14, 2021
CVE-2021-24347
SP Project & Document Manager <2 4.22 - Authenticated Shell Upload
8.8
CVSS
54.1%
EPSS
No
On KEV
Description
The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)54.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SP
SP Project & Document Manager ·
4.22 before 4.22 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-24347
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-24347
Exploit
http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html
Exploit
http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html
Exploit
https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a
More from SP Project & Document Manager
8.8
CVE-2021-4225
SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload
6.5
CVE-2024-3749
SP Project & Document Manager <= 4.71 - Subscriber+ File Download via IDOR
6.5
CVE-2024-3748
SP Project & Document Manager <= 4.71 - Data Update via IDOR
6.5
CVE-2022-1551
SP Project & Document Manager < 4.58 - Sensitive File Disclosure