CVEvulnerability
CVE-2021-45010
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2022-03-15
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-22
Description
A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.
Affected configurations
• prasathmani tiny file manager (<= 2.4.7)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
- https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/ Patch, Third Party Advisory
- https://github.com/febinrev/tinyfilemanager-2.4.3-exploit/raw/main/exploit.sh Exploit, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/commit/2046bbde72ed76af0cfdcae082de629bcc4b44c7 Patch, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/pull/636 Patch, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/pull/636/files/a93fc321a3c89fdb9bee860bf6df5d89083298d1 Patch, Third Party Advisory
- https://raw.githubusercontent.com/febinrev/tinyfilemanager-2.4.6-exploit/main/exploit.sh Exploit, Third Party Advisory
- https://sploitus.com/exploit?id=1337DAY-ID-37364&utm_source=rss&utm_medium=rss Exploit, Third Party Advisory
- http://packetstormsecurity.com/files/166330/Tiny-File-Manager-2.4.6-Shell-Upload.html Exploit, Third Party Advisory, VDB Entry
- https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/ Patch, Third Party Advisory
- https://github.com/febinrev/tinyfilemanager-2.4.3-exploit/raw/main/exploit.sh Exploit, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/commit/2046bbde72ed76af0cfdcae082de629bcc4b44c7 Patch, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/pull/636 Patch, Third Party Advisory
- https://github.com/prasathmani/tinyfilemanager/pull/636/files/a93fc321a3c89fdb9bee860bf6df5d89083298d1 Patch, Third Party Advisory
- https://raw.githubusercontent.com/febinrev/tinyfilemanager-2.4.6-exploit/main/exploit.sh Exploit, Third Party Advisory
- https://sploitus.com/exploit?id=1337DAY-ID-37364&utm_source=rss&utm_medium=rss Exploit, Third Party Advisory