## https://sploitus.com/exploit?id=156C1F8E-E328-5619-AAD0-B7C3DF011B08
# CVE-2021-3129
> Unauthenticated RCE in Laravel Ignition via File Upload
## Summary of the CVE
In affected versions of Laravel Ignition a attack can execute arbitrary code because of the insecure usage of `file_get_contents()` and `file_put_contents()`.
This is only exploitable for websites that use debug mode.
## Affected Versions
- Laravel Ignition < 2.5.2 and Laravel < 8.4.2
## Anomalies
- This exploit needs a php gadget and is therefore using phpggc. You can do this the following ways:
- If you haven't already cloned: `git clone https://github.com/cc3305/CVE-2021-3129.git --recursive --shallow-submodules`.
- Or if you have already cloned in, run this in the local git repo `git submodule update --init --depth 1`.
## References
- [Original Report - Charles Fol, Jan 12 2021](https://www.ambionics.io/blog/laravel-debug-rce)
- [First Github POC - SNCKER, Jan 24 2021](https://github.com/SNCKER/CVE-2021-3129)
- [Github POC - joshuavanderpoll, Aug 16 2023](https://github.com/joshuavanderpoll/CVE-2021-3129)
- [CVE-details - CVSS Score 7.5](https://www.cvedetails.com/cve/CVE-2021-3129/)