PT-2019-19331 · Sitemagic · Sitemagic Cms

CVE-2019-9042 · Publicado 2019-02-23 · Atualizado 2024-08-04

Positive Technologies (AI Summary)

CVSS v3.1

7.2

Alta

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitemagic CMS version 4.4

Description An issue in the index.php?SMExt=SMFiles URI allows users to upload .php files, potentially executing arbitrary code, as shown with 404.php. This issue can only occur if the administrator fails to set the FileExtensionFilter and if there are untrusted user accounts. The maintainer considers this a feature for use with External Modules rather than a vulnerability.

Recommendations For Sitemagic CMS version 4.4, set the FileExtensionFilter to prevent untrusted users from uploading executable files. Ensure that only trusted users have access to the system to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the index.php?SMExt=SMFiles URI until the issue is resolved.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-9042

Produtos afetados

Sitemagic Cms

Referências · 4

• 🔥 http://iwantacve.cn/index.php/archives/116 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9042 · Aviso do Fabricante
• https://t.me/cvenotify/89063 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2019-9042 · Nota de Segurança