PT-2018-14954 · Getsimple · Getsimple Cms

Hexifeo · Publicado 2018-11-21 · Atualizado 2018-12-28 · CVE-2018-19420

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions GetSimpleCMS version 3.3.15

Description The issue allows HTML execution through alternative file uploads. This can occur with files having no extension or unrecognized extensions, such as 'test' or 'test.asdf', due to vulnerabilities in admin/upload-uploadify.php and the validate safe file function in admin/inc/security functions.php.

Recommendations For GetSimpleCMS version 3.3.15, consider restricting or validating file uploads more strictly to prevent HTML execution, and review the validate safe file function in admin/inc/security functions.php to ensure it correctly handles files with no or unrecognized extensions.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-19420

Produtos afetados

Getsimple Cms

Referências · 4

• 🔥 https://github.com/GetSimpleCMS/GetSimpleCMS/issues/1301 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-19420 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-19420 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19420 · Nota