CVE-2021-47976
HighSummary
TextPattern CMS version 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.
Risk Assessment
This vulnerability poses a serious risk to organizations as it allows attackers to execute code remotely on the server, potentially leading to full system compromise. Consequently, this may result in data loss or security breaches.
Recommendation
It is recommended to update TextPattern CMS to the latest version that addresses this vulnerability. Additionally, implementing security measures such as restricting file upload functionality to trusted users is advisable.
Original NVD description (English source)
TextPattern CMS 4.9.0-dev contains a remote code execution vulnerability that allows authenticated attackers to upload arbitrary PHP files by exploiting the plugin upload functionality. Attackers can authenticate, retrieve a CSRF token from the plugin event page, and upload malicious PHP files to the textpattern/tmp/ directory for code execution.