CVEs-PoC/2021/CVE-2021-28132.md

CVE-2021-28132

Description

LUCY Security Awareness Software through 4.7.x allows unauthenticated remote code execution because the Migration Tool (in the Support section) allows upload of .php files within a system.tar.gz file. The .php file becomes accessible with a public/system/static URI.

POC

Reference

• https://abuyv.com/cve/lucy-file-upload-RCE

Github

No PoCs found on GitHub currently.