CVE-2021-47812
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
GravCMS 1.10.7 contains an unauthenticated vulnerability that allows remote attackers to write arbitrary YAML configuration and execute PHP code through the scheduler endpoint. Attackers can exploit the admin-nonce parameter to inject base64-encoded payloads and create malicious custom jobs with system command execution.
Analysis
GravCMS 1.10.7 allows unauthenticated remote attackers to write arbitrary YAML configuration files, leading to full server compromise through admin account creation or code execution.
Technical Context
GravCMS 1.10.7 exposes an endpoint without authentication checks (CWE-862) that processes user-supplied YAML content and writes it to the server's configuration directory. Since Grav uses YAML files for user accounts and system config, this enables creating admin accounts.
Affected Products
['GravCMS 1.10.7']
Remediation
Upgrade GravCMS immediately. Restrict write access to configuration directories at the web server level.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today