CVE-2021-41749 PoC — Nystudio107 Seomatic 代码注入漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41749.yaml

Associated Vulnerability

Title:Nystudio107 Seomatic 代码注入漏洞 (CVE-2021-41749)
Description:Nystudio107 Seomatic是美国的一个全面、强大和灵活的交钥匙 SEO 系统。促进了 Craft CMS 3 的现代 SEO 最佳实践和实施。 Nystudio107 Seomatic 3.4.11 版本及之前版本存在安全漏洞，未经身份验证的攻击者利用该漏洞可以执行服务器端模板注入，从而允许远程代码执行。

Description

In the SEOmatic plugin up to 3.4.11 for Craft CMS 3, it is possible for unauthenticated attackers to perform a Server-Side. Template Injection, allowing for remote code execution.

File Snapshot


 id: CVE-2021-41749

info:
  name: CraftCMS SEOmatic - Server-Side Template Injection
  author: iamno

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!