PT-2018-17521 · Monstra · Monstra Cms

Hexifeo · Publicado 2018-01-29 · Atualizado 2022-02-10 · CVE-2018-6383

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monstra CMS versions prior to 3.0.5

Description The issue is related to an incomplete list of forbidden file types, allowing remote authenticated Admins or Editors to execute arbitrary PHP code by uploading files with certain extensions, such as .pht or .phar.

Recommendations For Monstra CMS versions prior to 3.0.5, update to version 3.0.5 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary extensions and disabling the ability for Admins or Editors to upload files with .pht or .phar extensions.

Exploit

Correção

Incomplete List of Disallowed Inputs

Enumeração de Fraquezas

CWE-184

Identificadores relacionados

CVE-2018-6383

Produtos afetados

Monstra Cms

Referências · 7

• 🔥 https://github.com/monstra-cms/monstra/issues/429 · Exploit
• 🔥 https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit · Exploit
• 🔥 http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/49949 · Exploit
• https://t.me/cvenotify/15840 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2018-6383 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-6383 · Nota de Segurança