CVE-2021-24663 Simple School Staff Directory <= 1.1 - Admin+ Arbitrary File Upload
Administrators can upload arbitrary PHP files via the logo upload feature, leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-24663?
CVE-2021-24663 is a high-severity vulnerability in Unknown Simple Schools Staff Directory, published on 20 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
Weakness: CWE-434
Which versions are affected by CVE-2021-24663?
It affects 1 product.
Products include Simple Schools Staff Directory Project Simple Schools Staff Directory.
How do I fix CVE-2021-24663?
No fix has been published for CVE-2021-24663 yet. Limit exposure of the affected software until one is available.
Is CVE-2021-24663 being exploited?
There is no known exploitation of CVE-2021-24663 in the wild and no public exploit code.
Sources
Also known as GHSA-gg8c-wv43-x28x.