CVE-2021-27964

CRITICAL 9.8CVE-2021-27964 · Published 05/03/2021 · updated 17/06/2026

In short

CVE-2021-27964 is a CRITICAL (CVSS 9.8) vulnerability affecting sonlogger (sfcyazilim).
Chance of exploitation in the next 30 days (EPSS): 47.5%, higher than 98.8% of all vulnerabilities.
Fix: update to 6.4.1 or later.

Package	Affected versions	Patched versions
sonlogger sfcyazilim	`< 6.4.1`	`6.4.1`

Description

SonLogger before 6.4.1 is affected by Unauthenticated Arbitrary File Upload. An attacker can send a POST request to /Config/SaveUploadedHotspotLogoFile without any authentication or session header. There is no check for the file extension or content of the uploaded file.

References

packetstormsecurity.com/files/161793/SonLogger-4.2.3.3-Shell-Upload.html · Exploit
erberkan/SonLogger-vulns · Exploit
sonlogger.com/releasenotes · Release Notes

More vulnerabilities in sonlogger

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free