PT-2018-10302 · Mybiz · Myprocurenet

Ahmad Ramadhan Amizudin + 3 · Published 2018-05-14 · Updated 2019-11-12 · CVE-2018-11091

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MyBiz MyProcureNet version 5.0.0

Description An issue allows a malicious file to be uploaded to the webserver, enabling an attacker to upload a script and issue operating system commands. This occurs because the HiddenFieldControlCustomWhiteListedExtensions parameter can be adjusted by an attacker to add arbitrary extensions to the whitelist during upload, allowing malicious files to be uploaded and executed to take over the server.

Recommendations For MyBiz MyProcureNet version 5.0.0, restrict access to the file upload feature and remove any custom extensions from the HiddenFieldControlCustomWhiteListedExtensions parameter to prevent malicious file uploads. Additionally, consider disabling the file upload feature until a fix is available to prevent exploitation.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-11091

Affected Products

Myprocurenet

References · 7

• https://osv.dev/vulnerability/CVE-2018-11091 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-11091 · Security Note
• https://security.freebsd.org/advisories/FreeBSD-SA-19:26.mcu.asc · Vendor Advisory
• http://seclists.org/fulldisclosure/2018/May/32 · Note
• http://packetstormsecurity.com/files/155281/FreeBSD-Security-Advisory-FreeBSD-SA-19-26.mcu.html · Note
• https://seclists.org/bugtraq/2019/Nov/16 · Note
• https://sec-consult.com/en/blog/advisories/arbitrary-file-upload-cross-site-scripting-in-mybiz-myprocurenet · Note