CVE-2017-18048

Опубликовано: 23 янв. 2018

Источник: nvd

CVSS3: 8.8

CVSS2: 6.5

EPSS Высокий

Описание

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

Ссылки

https://blogs.securiteam.com/index.php/archives/3559
Exploit
Third Party Advisory
https://github.com/monstra-cms/monstra/issues/426
Patch
Third Party Advisory
https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/43348/
Exploit
Third Party Advisory
VDB Entry
https://blogs.securiteam.com/index.php/archives/3559
Exploit
Third Party Advisory
https://github.com/monstra-cms/monstra/issues/426
Patch
Third Party Advisory
https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
Exploit
Third Party Advisory
https://www.exploit-db.com/exploits/43348/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:monstra:monstra:3.0.4:*:*:*:*:*:*:*

EPSS

Процентиль: 99%

0.77014

Высокий

8.8 High

CVSS3

6.5 Medium

CVSS2

Дефекты

CWE-434

Связанные уязвимости

GHSA-9gjw-qvrh-6f5r