PT-2018-14639 · Lulu · Lulu Cms

Jackkong1 · Publicado 2018-10-29 · Atualizado 2018-12-11 · CVE-2018-18771

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LuLu CMS versions prior to 2015-05-14

Description An issue was discovered that allows arbitrary file upload. This is achieved by entering a filename, directory name, and PHP code into the three text input fields in the backendmodulesfilemanagercontrollersDefaultController.php file.

Recommendations For versions prior to 2015-05-14, restrict access to the backendmodulesfilemanagercontrollersDefaultController.php file to minimize the risk of exploitation. As a temporary workaround, consider disabling the file upload functionality in the DefaultController.php file until a fix is applied.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-18771

Produtos afetados

Lulu Cms

Referências · 3

• https://github.com/yiifans/lulucms/issues/6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-18771 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-18771 · Aviso do Fabricante