PT-2018-13709 · Cscms · Cscms

Publicado 2018-09-08 · Atualizado 2018-10-30 · CVE-2018-16731

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CScms version 4.1

Description The issue allows for arbitrary file upload. This can be achieved by modifying the default filetype list, which includes gif, jpg, and png, to accept other file types, such as php. An attacker can then specify a .php pathname within fileurl JSON data to upload malicious files.

Recommendations For CScms version 4.1, restrict the file types that can be uploaded to prevent arbitrary file upload. As a temporary workaround, consider disabling the file upload feature until a patch is available. Avoid using the fileurl JSON data to upload files with potentially malicious extensions, such as .php, until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-16731

Produtos afetados

Cscms

Referências · 4

• 🔥 https://patec.cn/newsshow.php?cid=24&id=123 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16731 · Nota de Segurança
• ❌ https://github.com/AvaterXXX/CScms/blob/master/CScms_up.md · Nota, Deleted
• https://osv.dev/vulnerability/CVE-2018-16731 · Aviso do Fabricante