PT-2018-12795 · Ukcms · Ukcms

Porlockzzz · Publicado 2018-08-03 · Atualizado 2018-10-10 · CVE-2018-14911

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ukcms versions 1.1.7 and earlier

Description A file upload issue exists due to insufficient filtering of the file upload type. An attacker can exploit this by uploading a script Trojan to the admin.php/admin/configset/index/group/upload.html endpoint to gain server control. This is achieved by initially composing a request for a .txt upload and then modifying it to a .php upload. The attacker must have admin access to alter the upload file ext setting, also known as "Allow upload file suffix", and use "php,php" in this setting to bypass the "php" restriction.

Recommendations For ukcms versions 1.1.7 and earlier, as a temporary workaround, consider restricting access to the admin.php/admin/configset/index/group/upload.html endpoint until a patch is available. Additionally, restrict the use of the upload file ext setting to prevent bypassing the "php" restriction.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-14911

Produtos afetados

Ukcms

Referências · 3

• 🔥 https://github.com/yxcmf/ukcms/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2018-14911 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-14911 · Nota de Segurança