PT-2018-11541 · Hongcms · Hongcms

Sm0Nk · Publicado 2018-06-29 · Atualizado 2018-08-21 · CVE-2018-13021

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0

Description An issue was discovered that allows for Arbitrary Script File Upload, which can result in PHP code execution. This is achievable via the "admin/index.php/template/upload" API endpoint.

Recommendations For HongCMS version 3.0.0, consider restricting access to the "admin/index.php/template/upload" endpoint until a patch is available. As a temporary workaround, disabling the upload functionality in the template section can help minimize the risk of exploitation.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-13021

Produtos afetados

Hongcms

Referências · 3

• 🔥 https://github.com/Neeke/HongCMS/issues/5 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13021 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-13021 · Nota de Segurança