CVE-2021-37367

Vulnerability

CTparental before version 4.45.07 is affected by a code execution vulnerability in the admin panel. The file bl_categories_help.php is vulnerable to directory traversal, allowing an attacker to create a file containing arbitrary scripts and execute commands [1]. Affected versions include 4.45.02m and all earlier releases up to 4.45.06.

Exploitation

An attacker must have administrative access to the CTparental admin panel. By crafting a directory traversal payload in the bl_categories_help.php file, the attacker can write a script to a location outside the web root and then trigger its execution, leading to command execution [1]. No user interaction other than the attacker's own admin session is required.

Impact

Successful exploitation allows the attacker to execute arbitrary commands on the server with the privileges of the web server user. This results in full compromise of confidentiality, integrity, and availability (CIA) of the CTparental application and potentially the underlying system [1]. The CVSS score for this vulnerability is 7.8 (High).

Mitigation

The vulnerability is fixed in CTparental version 4.45.07 [1]. Users should upgrade to this or any later release. No workaround is mentioned in the available references. Ensure that the admin panel is not exposed to untrusted networks.