CVE-2021-47936 - Vulnerability Analysis

Overview

OpenCATS 0.9.4 contains a remote code execution vulnerability caused by unrestricted file upload of malicious PHP files via the careers job application endpoint, letting unauthenticated attackers execute arbitrary system commands remotely.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary system commands, potentially leading to full server compromise.

Mitigation

Update to the latest version of OpenCATS.

References

• https://github.com/opencats/OpenCATS
• https://www.exploit-db.com/exploits/50585
• https://www.opencats.org/
• https://www.vulncheck.com/advisories/opencats-remote-code-execution-via-resume-upload

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner