CVEvulnerability
CVE-2021-3164
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2021-01-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
ChurchRota 2.6.4 is vulnerable to authenticated remote code execution. The user does not need to have file upload permission in order to upload and execute an arbitrary file via a POST request to resources.php.
Affected configurations
• churchdesk churchrota 2.6.4
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://github.com/Little-Ben/ChurchRota Third Party Advisory
- https://github.com/rmccarth/cve-2021-3164 Exploit, Third Party Advisory
- https://github.com/Little-Ben/ChurchRota Third Party Advisory
- https://github.com/rmccarth/cve-2021-3164 Exploit, Third Party Advisory