PT-2017-13002 · Blackcat · Blackcat Cms

Publicado 2017-08-31 · Atualizado 2019-10-03 · CVE-2017-13670

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BlackCat CMS version 1.2

Description The issue allows remote authenticated users to upload any file, including malicious ones, via the media upload function. This is demonstrated by uploading a ZIP archive containing a .php file through the backend/media/ajax upload.php endpoint.

Recommendations For BlackCat CMS version 1.2, consider restricting access to the backend/media/ajax upload.php endpoint to prevent unauthorized file uploads until a fix is available. As a temporary workaround, restrict the types of files that can be uploaded through this endpoint to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2017-13670

Produtos afetados

Blackcat Cms

Referências · 3

• 🔥❌ https://github.com/M4ple/vulnerability/blob/master/blackcat_cms_RCE/blackcat_cms_RCE.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2017-13670 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-13670 · Aviso do Fabricante