PT-2018-18799 · Monstra · Monstra Cms

Sunu11 · Publicado 2018-04-10 · Atualizado 2018-05-17 · CVE-2018-9037

Positive Technologies (AI Summary)

CVSS v3.1

8.8

Alta

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4

Description The issue allows remote code execution via an upload file request for a .zip file. This .zip file is automatically extracted and may contain .php files, leading to potential code execution.

Recommendations For Monstra CMS version 3.0.4, consider disabling the upload functionality for .zip files or restricting the types of files that can be uploaded to prevent remote code execution until a patch is available.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2018-9037

Produtos afetados

Monstra Cms

Referências · 4

• 🔥 https://github.com/monstra-cms/monstra/issues/433 · Exploit
• 🔥 https://exploit-db.com/exploits/44621 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9037 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2018-9037 · Aviso do Fabricante