CVE-2021-46113

Katalog CVE

CVSS 8.8 · High EPSS 3,1%

Kerentanan Unrestricted Upload of File with Dangerous Type pada kea-hotel-erp project kea-hotel-erp. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

In MartDevelopers KEA-Hotel-ERP open source as of 12-31-2021, a remote code execution vulnerability can be exploited by uploading PHP files using the file upload vulnerability in this service.

Rincian

Terbit di NVD

25 Januari 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

3,1% peluang dieksploitasi; lebih tinggi dari 87,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gist.github.com/P0cas/5aa55f62781364a750ac4a4d47f319fa#cve-2021-46113 exploit · advisory pihak ketiga
• https://www.youtube.com/watch?v=gnSMrvV5e9w exploit · advisory pihak ketiga
• https://blog.pocas.kr/posts/rce-KEA-Hotel-ERP/ broken link