Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2021-44664

Quick assessment

Affected
n/a n/a
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Xerte是英国The Xerte Project社区的一个开源软件。用于创作学习对象。 Xerte存在代码问题漏洞，该漏洞通过伪装成语言文件的项目接口上传一个恶意制作的php文件，以绕过上传过滤器。攻击者可利用该漏洞可以通过滥用“mediapath”变量中的路径遍历来操纵文件的目的地。

AI Predicted 9.8 Difficulty: Easy EPSS 12.78% · P96

Public Exploits 1

ExploitDB · 1 EDB-50795 [webapps]
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2021-44664

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload filters. Attackers can manipulate the files destination by abusing path traversal in the 'mediapath' variable.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Xerte 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Xerte是英国The Xerte Project社区的一个开源软件。用于创作学习对象。 Xerte存在代码问题漏洞，该漏洞通过伪装成语言文件的项目接口上传一个恶意制作的php文件，以绕过上传过滤器。攻击者可利用该漏洞可以通过滥用“mediapath”变量中的路径遍历来操纵文件的目的地。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
- n/a n/a -

II. Public POCs for CVE-2021-44664

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2021-44664

请登录查看更多情报信息。

Patches & Fixes for CVE-2021-44664 (2)

Exploits & Public PoCs for CVE-2021-44664 (1)

Other References for CVE-2021-44664 (1)

Same Patch Batch · n/a · 2022-02-24 · 41 CVEs total

CVE-2021-44662 Xerte 跨站脚本漏洞
CVE-2022-25004 Sourcecodester Hospital Patient Records Management System SQL注入漏洞
CVE-2022-23135 Zte Zxhn F677 路径遍历漏洞
CVE-2022-0544 Blender 数字错误漏洞
CVE-2022-0545 Blender输入验证错误漏洞
CVE-2022-0546 Blender 输入验证错误漏洞
CVE-2021-4021 radare2 资源管理错误漏洞
CVE-2021-3700 usbredirparser 资源管理错误漏洞
CVE-2021-3607 QEMU 输入验证错误漏洞
CVE-2021-3608 QEMU 缓冲区错误漏洞
CVE-2022-25003 Sourcecodester Hospital Patient Records Management System SQL注入漏洞
CVE-2021-44663 Xerte 安全漏洞
CVE-2021-44665 Xerte 路径遍历漏洞
CVE-2021-43745 Trilium Notes 安全漏洞
CVE-2021-29216 HPE OneView Global Dashboard 跨站脚本漏洞
CVE-2021-29217 HPE OneView Global Dashboard 输入验证错误漏洞
CVE-2022-23701 HPE Integrated Lights-Out 4 注入漏洞
CVE-2021-29220 HPE iLO Amplifier Pack 安全漏洞
CVE-2021-39364 Honeywell HDZP252DI 1.00.HW02.4 安全漏洞
CVE-2021-39363 Honeywell HDZP252DI 1.00.HW02.4和HBW2PER1 1.00. hw01.3 命令注入漏洞

Showing top 20 of 41 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: n/a
Same vendor: n/a

V. Comments for CVE-2021-44664

No comments yet

Leave a comment