Exploit for Unrestricted Upload of File with Dangerous Type in Churchdb Churchinfo

CVE-2021-43258 ChurchInfo 1.2.13-1.3.0 Remote Code Execution...

Remote code execution

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores...

CVE-2021-43258

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores...

CVE-2021-43258: Unrestricted Upload of File with Dangerous Type

CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. This requires authenticated access tot he ChurchInfo application. Once authenticated, a user can add names to their cart, and compose an email. Uploading an attachment for the email stores...

ChurchInfo 1.2.13-1.3.0 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ChurchInfo 1.2.13-1.3.0 Authenticated RCE', 'Description' = %q This module exploits the logic in the CartView.php page when crafting a draft emai...