CVE-2022-46604 PoC — Tecrail Responsive FileManager 代码问题漏洞

Source

https://github.com/galoget/ResponsiveFileManager-CVE-2022-46604

Associated Vulnerability

Title: Tecrail Responsive FileManager 代码问题漏洞 (CVE-2022-46604)
Description:An issue in Tecrail Responsive FileManager v9.9.5 and below allows attackers to bypass the file extension check mechanism and upload a crafted PHP file, leading to arbitrary code execution.

Description

Responsive FileManager v.9.9.5 vulnerable to CVE-2022-46604.

Readme

# ResponsiveFileManager-CVE-2022-46604
Responsive FileManager v.9.9.5 vulnerable to CVE-2022-46604 (File Creation Extension Bypass which leads to RCE).

The current exploit is made in Python 3 and exploits the vulnerability to upload a webshell which allows the remote execution of commands in the vulnerable host.

## References
- Exploit Database (Exploit-DB): https://www.exploit-db.com/exploits/51251
- Packet Storm Security: https://packetstormsecurity.com/files/171720/Responsive-FileManager-9.9.5-Remote-Shell-Upload.html

### Demo

![CVE-2022-46604 exploit PoC](CVE-2022-46604-exploit-PoC.png "CVE-2022-46604 exploit PoC")

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →