Login Request a demo
High severity · published Mar 15, 2022
CVE-2021-45010
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to…
8.8
CVSS
70.1%
EPSS
No
On KEV
Description
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)70.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
TF
Tiny File Manager · Prasathmani
through 2.4.7 · source: NVD
Affected product
TF
Tiny File Manager
Prasathmani
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-45010
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-45010
Exploit
http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html
Patch
https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/
Exploit
https://github.com/febinrev/tinyfilemanager-2.4.3-exploit/raw/main/exploit.sh
Patch
https://github.com/prasathmani/tinyfilemanager/commit/2046bbde72ed76af0cfdcae082de629bcc4b44c7
Patch
https://github.com/prasathmani/tinyfilemanager/pull/636
Patch
https://github.com/prasathmani/tinyfilemanager/pull/636/files/a93fc321a3c89fdb9bee860bf6df5d89083298d1
More from Tiny File Manager
9.8
CVE-2022-40916
Tiny File Manager v2.4.7 and below is vulnerable to session fixation
9.8
CVE-2022-45476
Tiny File Manager version 2.4.8 executes the code of files uploaded by users of the application, instead of just returning them for download
9.8
CVE-2022-1000
Path Traversal in GitHub repository prasathmani/tinyfilemanager prior to 2.4.7
8.8
CVE-2022-23044
Tiny File Manager version 2.4.8 allows an unauthenticated remote attacker to persuade users to perform unintended actions within the application
8.8
CVE-2021-40965
A Cross-Site Request Forgery (CSRF) vulnerability exists in TinyFileManager all version up to and including 2.4.6 that allows attackers to upload files and run OS commands by…