CVE-2021-23394: elFinder < 2.1.58 - Remote Code Execution
HoneyLabs honeypots recorded 6 probes matching CVE-2021-23394 from 1 distinct source IP address in the last 7 days. Severity is rated high.
Request paths that identify it
- /elFinder/php/connector.minimal.php?cmd=put&target={{*}}&content=<?='';+echo+md5('{{*}}');+?>
- /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name={{*}}.phar
Addresses probing it
| Source IP | Probes | Network | Country |
|---|---|---|---|
| 93.123.109.214 | 6 | Techoff Srv Limited | Bulgaria |
Networks it comes from
| ASN | Organisation | Probes | Source IPs |
|---|---|---|---|
| AS48090 | Techoff Srv Limited | 6 | 1 |
Where it comes from
| Country | Probes |
|---|---|
| Bulgaria | 6 |
Captured requests
- /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name=3Kht1Hc1ryl3CKzETNDnae9Fgls.phar
- /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name=3KSZIhg3nbz9ReqTBrWlbqF2tBg.phar
- /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name=3KenfHQTNeUExII3H0YBs2qkATb.phar
- /elFinder/php/connector.minimal.php?cmd=mkfile&target=l1_Lw&name=3KVZrFNrabzPPEzQWz7I3xLLmON.phar
HTTP client fingerprints
- b11cun050_00040017_e873236c
CVE report
CVE report
Open a specific CVE from the CVE tracker.