CVE-2021-42669
📋 TL;DR
This CVE describes a critical file upload vulnerability in Sourcecodester Engineers Online Portal that allows attackers to upload PHP webshells to execute arbitrary commands on the web server. The vulnerability affects all users of the vulnerable software version and can lead to complete system compromise. Attackers can exploit this without authentication by uploading malicious files through the teacher avatar functionality.
💻 Affected Systems
- Sourcecodester Engineers Online Portal
📦 What is this software?
Engineers Online Portal by Engineers Online Portal Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining root/system-level access, data exfiltration, ransomware deployment, and lateral movement to other systems.
Likely Case
Web server compromise leading to data theft, defacement, cryptocurrency mining, or use as part of a botnet.
If Mitigated
Limited impact with proper file upload validation and directory restrictions preventing malicious file execution.
🎯 Exploit Status
Multiple public proof-of-concept exploits exist demonstrating remote code execution via simple file upload.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
Restart Required: No
Instructions:
1. Check vendor website for updated version. 2. Replace vulnerable files with patched versions. 3. Remove any uploaded malicious files from /admin/uploads/ directory.
🔧 Temporary Workarounds
File Upload Restriction
allImplement strict file upload validation to only allow image files and prevent PHP execution in upload directory.
# Add to .htaccess in uploads directory:
<FilesMatch "\.(php|php5|php7|phtml|phar)$">
Order Deny,Allow
Deny from all
</FilesMatch>
# Restrict file types in PHP:
$allowed_types = array('jpg', 'jpeg', 'png', 'gif');
$file_extension = strtolower(pathinfo($filename, PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_types)) {
die('Invalid file type');
}
Directory Access Control
allMove upload directory outside web root or restrict access to authenticated users only.
# Move uploads directory outside web root
mv /var/www/html/admin/uploads /var/uploads
# Update code to reference new location
# Add authentication check to teacher_avatar.php
session_start();
if (!isset($_SESSION['teacher_id'])) {
header('Location: login.php');
exit();
}
🧯 If You Can't Patch
- Disable or remove the vulnerable teacher avatar upload functionality entirely.
- Implement web application firewall (WAF) rules to block file uploads containing PHP code and monitor for exploit attempts.
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a PHP file through the teacher avatar functionality at dashboard_teacher.php and check if it's accessible and executable.Check Version:
# Check PHP files for version information
grep -r "version\|Version" /path/to/engineers-portal/ | head -5Verify Fix Applied:
Test that PHP files cannot be uploaded or executed from the uploads directory, and verify proper file type validation is in place.📡 Detection & Monitoring
Log Indicators:
- File uploads with .php extension to /admin/uploads/
- Unusual POST requests to teacher_avatar.php
- Commands executed via GET parameters to files in uploads directory
Network Indicators:
- HTTP requests to /admin/uploads/*.php?cmd=*
- Unusual outbound connections from web server
SIEM Query:
source="web_server_logs" AND (uri_path="/admin/uploads/*.php" OR uri_path="/teacher_avatar.php") AND (method="POST" OR query_string="*cmd=*")🔗 References
- https://github.com/TheHackingRabbi/CVE-2021-42669
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42671
- https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
- https://github.com/TheHackingRabbi/CVE-2021-42669
- https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-42671
- https://www.sourcecodester.com/php/13115/engineers-online-portal-php.html
