CVE-2021-24347 — SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

Description

The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".

Affected products

Vendor	Product	Affected	Fixed
—	SP Project & Document Manager	4.22 – < 4.22	4.22

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Wordpress Plugin SP Project and Document - Authenticated Remote Code Execution
exploit/multi/http/wp_plugin_sp_project_document_rce

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

WordPress SP Project & Document Manager <4.22 - Authenticated Shell Upload http/cves/2021/CVE-2021-24347.yaml

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.