Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.# CVE-2021-32708
Affected versions of this package are vulnerable to Race Condition. The whitespace normalisation using in 1.x and 2.x removes any unicode whitespace. Under certain specific conditions this could potentially allow a malicious user to execute code remotely.
How the Exploit Works
Unicode Bypass: The filename exploit\u202Ephp.txt uses the Right-to-Left Override (RLO) character to disguise the file extension.
Malicious File Upload: The file is uploaded and stored on the server.
Payload Execution: If the server allows code execution in the uploads directory, the attacker can run the PHP payload remotely.
[4.0K] /data/pocs/7791cccf73fad3aee830d31bbdb717fca90750f3
├── [1.1K] CVE-2021-32708_exploit.py
├── [1.0K] CVE-2021-32708_scanner.py
└── [ 626] README.md
0 directories, 3 files