CVE-2021-32172

What it actually does

CVE-2021-32172 is a pre-authentication remote code execution vulnerability in Maian Cart v3.8 caused by broken access control around the bundled Elfinder file-management plugin. Because access control is not properly enforced before sensitive file-manager functionality is exposed, an unauthenticated remote attacker can interact with Elfinder capabilities that should be restricted to administrators. If upload or file-write operations are reachable, the attacker can place executable server-side content, such as a PHP web shell, in a web-accessible location and execute arbitrary commands with the privileges of the web server process. The CVSS 9.8 rating reflects network exploitability, no authentication requirement, no user interaction, and full confidentiality, integrity, and availability impact.

Why it matters to the business

Successful exploitation can give an attacker direct control over the affected Maian Cart web application and potentially the underlying hosting account. For an e-commerce platform, this can lead to storefront defacement, order or customer-data theft, payment-skimming malware, service outage, fraudulent content changes, and use of the server as a foothold for broader compromise. The exploit is assessed as weaponized and has a high EPSS score, meaning internet-facing vulnerable deployments should be treated as high-priority even though the issue is not currently listed in CISA KEV.

How an attack unfolds

An attacker scans for publicly reachable Maian Cart v3.8 installations and probes for exposed Elfinder plugin endpoints. Because the plugin access control is broken, the attacker does not need valid credentials. They interact with the file manager endpoint directly, typically attempting to upload or create a PHP payload, rename files, or write content into a web-accessible directory. Once the malicious file is accessible over HTTP, the attacker requests it to execute commands on the server. From there, they may enumerate configuration files for database credentials, dump customer and order data, install persistence through additional web shells or modified application files, inject JavaScript skimmers into storefront templates, or pivot to other services reachable from the web server.

How to fix it

Upgrade Maian Cart to a version that removes or fixes the vulnerable Elfinder exposure if a vendor-supported fixed release is available. No exact fixed version was provided in the input, so affected organizations should verify current vendor guidance from Maian Script World and avoid running Maian Cart v3.8 with the vulnerable plugin exposed. If immediate upgrade is not possible, remove or disable the Elfinder plugin, restrict access to administrative and file-manager paths by authentication and IP allowlisting, block direct web access to upload directories, disable execution of PHP and other scripts in writable directories, and apply least-privilege permissions to the web server account. Review web-root contents for unauthorized files before returning the system to service, because patching alone will not remove existing web shells.

How to confirm the fix worked

Confirm the deployed Maian Cart version is not v3.8 or otherwise confirmed vulnerable by the vendor. Verify that Elfinder endpoints are no longer reachable without authentication by requesting known plugin/file-manager paths from an unauthenticated session and confirming they return a denial, redirect to login, or 404 rather than file-manager JSON/API responses. Validate that writable upload directories do not execute PHP by placing a benign test file with a non-executable extension and confirming server configuration blocks script execution in those paths. Review file permissions so the web server cannot write to application code directories. After remediation, perform a web-root integrity check against a clean distribution or backup and confirm no suspicious PHP files, modified templates, or unexpected scheduled tasks remain.

Typical attack path

1. Identify internet-facing Maian Cart installations, especially version 3.8.
2. Probe for accessible Elfinder plugin endpoints without authentication.
3. Use the broken access control condition to access file-manager functions as an unauthenticated user.
4. Upload, create, or modify a server-side executable file such as a PHP web shell in a web-accessible path.
5. Send HTTP requests to the uploaded payload to execute operating-system commands under the web server account.
6. Read application configuration files and database credentials, modify storefront files, or extract customer/order data.
7. Establish persistence by adding additional web shells, backdoors, cron jobs, or modified PHP files.
8. Cover tracks by deleting uploaded archives, changing timestamps, or removing obvious request artifacts where possible.

How to detect it

Review web server access logs, application logs, file integrity telemetry, EDR events, and hosting control-panel logs for evidence of unauthenticated access to Elfinder endpoints followed by file upload or command execution. Look for HTTP requests to paths containing elfinder, connector, file manager, upload, or suspicious PHP filenames, especially POST requests that return successful 200 responses from unauthenticated clients. Examine the web root, upload directories, plugin directories, cache directories, and template directories for recently created or modified PHP files, unexpected archive files, obfuscated code, or files with image-like names but PHP content. Search for web shell command parameters such as cmd=, exec=, shell=, pass=, or command= in query strings and POST bodies where available. On the host, investigate web server child processes spawning command interpreters or system utilities such as sh, bash, cmd, powershell, wget, curl, nc, python, perl, or php. Check for outbound connections from the web server to unfamiliar IPs, newly added cron jobs, unauthorized admin accounts, modified payment or checkout templates, and database export activity. If threat hunting spans historical logs, prioritize periods after public disclosure and any time the application was internet-facing without compensating controls.

• /elfinder/
• elfinder.html
• connector.php
• php/connector.minimal.php
• cmd=upload
• cmd=mkfile
• cmd=put
• cmd=rename
• cmd=archive
• cmd=extract
• cmd=exec
• target=l
• upload[]=
• Content-Disposition: form-data; name="upload[]"
• .php.jpg
• .phtml
• c99.php
• r57.php
• wso.php
• b374k.php
• FilesMan
• WSOsetcookie
• eval(base64_decode(
• assert($_POST
• system($_GET
• passthru($_REQUEST
• shell_exec($_POST
• preg_replace("/.*?/e"
• POST /elfinder
• GET /elfinder
• /upload/
• /uploads/

What your security team should do

• Treat any internet-facing Maian Cart v3.8 deployment as urgent due to CVSS 9.8 severity, pre-authentication exploitability, high EPSS, and weaponized exploit maturity.
• Immediately inventory Maian Cart instances and determine whether the Elfinder plugin is present or reachable from the internet.
• Disable or remove Elfinder access until the application is upgraded or vendor-confirmed mitigations are in place.
• Restrict administrative and plugin paths using network controls such as VPN, IP allowlisting, or web application firewall rules.
• Hunt for prior compromise before and after patching, focusing on uploaded PHP files, web shell behavior, suspicious POST requests, and unexpected changes to storefront templates.
• Rotate credentials stored on the affected application host, including database, payment integration, SMTP, and administrative credentials, if compromise is suspected.
• Block script execution in upload and media directories and monitor for new executable files under the web root.
• Restore from known-good backups if unauthorized code execution or persistent web shells are confirmed.