CSRF-to-RCE-on-Backdrop-CMS

CSRF to RCE su Backdrop CMS 1.20 Questa PoC descrive come sfruttare CSRF su Backdrop CMS versione 1.20 con escalation a RCE. ID CVE CVE-2021-45268 Descrizione La versione 1.20 di Backdrop CMS consente di aggiungere plugin tramite file ZIP caricati sul sito. E poiché non dispone di protezione...

CVE-2021-45268

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...

CVE-2021-45268

CVE-2021-45268 concerns Backdrop CMS 1.20 with a CSRF vulnerability that can lead to remote code execution on the hosting server by uploading a crafted PHP add-on. The vendor notes the attack requires a high-privileged authenticated user with permission to install add-ons. Multiple sources (NVD, ...

CVE-2021-45268

A Cross Site Request Forgery CSRF vulnerability exists in Backdrop CMS 1.20, which allows Remote Attackers to gain Remote Code Execution RCE on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file. NOTE: the vendor disputes this because the attack requires a session cook...