GHSA-rgg3-3wh7-w935

Unrestricted Upload of File with Dangerous Type in Zenario CMS

Source: GitHub Advisory Database (reviewed) Critical CVE-2021-42171

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	tribalsystems/zenario	< 9.0.55143	9.0.55143

Details

As written in the advisory (Markdown source, shown as plain text).

Zenario CMS 9.0.54156 is vulnerable to File Upload. The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-42171 advisory
https://github.com/hieuminhnv/Zenario-CMS-9.0-last-version/issues/2 web
https://github.com/TribalSystems/Zenario/commit/4566d8a9ac6755f098b3373252fdb17754a77007 web
https://github.com/TribalSystems/Zenario package
https://github.com/TribalSystems/Zenario/releases/tag/9.0.55141 web
https://minhnq22.medium.com/file-upload-to-rce-on-zenario-9-0-54156-cms-fa05fcc6cf74 web
http://packetstormsecurity.com/files/166617/Zenario-CMS-9.0.54156-Remote-Code-Execution.html web