critical9.8Public exploit code
CVE-2021-27964
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- SonLogger 4.2.3.3 - Unauthenticated Arbitrary File Upload (Metasploit)2021-03-15 · webapps · multiple · Verified
Impact
SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Sfcyazilim | Sonlogger | before 6.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/161793/SonLogger-4.2.3.3-Shell-Upload.html
- https://github.com/erberkan/SonLogger-vulns
- https://www.sonlogger.com/releasenotes
- http://packetstormsecurity.com/files/161793/SonLogger-4.2.3.3-Shell-Upload.html
- https://github.com/erberkan/SonLogger-vulns
- https://www.sonlogger.com/releasenotes