PT-2018-14052 · Naviwebs · Naviwebs Navigate Cms

Pyriphlegethon · Publicado 2018-10-03 · Atualizado 2018-11-19 · CVE-2018-17553

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Naviwebs Navigate CMS version 2.8

Description The issue concerns an "Unrestricted Upload of File with Dangerous Type" with directory traversal in navigate upload.php, allowing authenticated attackers to achieve remote code execution. This is done via a POST request with engine set to 'picnik' and id set to '../../../navigate info.php', which enables directory traversal.

Recommendations For Naviwebs Navigate CMS version 2.8, consider restricting access to the navigate upload.php file to prevent unauthorized uploads and directory traversal attacks. As a temporary workaround, restrict the engine parameter to prevent it from being set to 'picnik' and limit the id parameter to prevent directory traversal.

Exploit

Correção

Unrestricted File Upload

Path traversal

Enumeração de Fraquezas

CWE-434

CWE-22

Identificadores relacionados

CVE-2018-17553

Produtos afetados

Naviwebs Navigate Cms

Referências · 6

• 🔥 https://github.com/rapid7/metasploit-framework/pull/10704 · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/navigate_cms_rce.rb · Exploit
• 🔥 https://exploit-db.com/exploits/45561 · Exploit
• https://github.com/NavigateCMS/Navigate-CMS/commit/2bdcb8b3c5bb23851a2115db96585f1ac8cb2d1e · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17553 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-17553 · Aviso do Fabricante