by Kastro
Paper/Archive/CVE-2021-47812

CVE-2021-47812

Getgrav GravCMS — GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)

EPSS 2%public exploitCVSS 9.8
critical.is priorityof 100
56
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 82.5.825 × 2016.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.

Affected

ProductAffectedFixed inSource
GravCMS1.10.7–CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitexploit-db.com/exploits/49973refgetgrav.orgwriteupvulncheck.com/advisories/gravcms-arbitrary-yaml-writeupdate-unauthenticated