CVE-2021-40964 PoC — TinyFileManager 路径遍历漏洞

Source

Associated Vulnerability

Description

Tiny File Manager <= 2.4.6 - Remote Code Execution (RCE)

Readme

# Tiny File Manager <= 2.4.6 - Remote Code Execution (Authenticated)

![Exploit Status](https://img.shields.io/badge/status-working-brightgreen)
![Language](https://img.shields.io/badge/bash-script-blue)
![CVE](https://img.shields.io/badge/CVE-2021--40964-red)

## 🚨 About the Exploit

This is a Bash-based authenticated **Remote Code Execution (RCE)** exploit for **Tiny File Manager versions <= 2.4.6**, vulnerable under **CVE-2021-40964**.

The script leverages:
- Weak upload validation and webroot disclosure,
- An arbitrary file upload vulnerability, leading to PHP code execution.

---

## 📌 Details

- **Exploit Title:** Tiny File Manager <= 2.4.6 - Remote Code Execution (RCE)
- **CVE:** [CVE-2021-40964](https://nvd.nist.gov/vuln/detail/CVE-2021-40964)
- **Author:** `Z3R0 (0x30)`
- **Vulnerable Version:** ≤ 2.4.6
- **Authentication Required:** Yes (Admin credentials)

---

## ⚙️ Prerequisites

Ensure the following tools are installed:

```bash
sudo apt install curl jq

File Snapshot

 [4.0K]  /data/pocs/ca6930ff6b33016b78765d9cea1c38dc924a6ec6
├── [2.5K]  CVE-2021-40964_ZERO.sh
└── [ 995]  README.md

0 directories, 2 files

Remarks