PT-2018-11541 · Hongcms · Hongcms

Sm0Nk · Published 2018-06-29 · Updated 2018-08-21 · CVE-2018-13021

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions HongCMS version 3.0.0

Description An issue was discovered that allows for Arbitrary Script File Upload, which can result in PHP code execution. This is achievable via the "admin/index.php/template/upload" API endpoint.

Recommendations For HongCMS version 3.0.0, consider restricting access to the "admin/index.php/template/upload" endpoint until a patch is available. As a temporary workaround, disabling the upload functionality in the template section can help minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-13021

Affected Products

Hongcms

References · 3

• 🔥 https://github.com/Neeke/HongCMS/issues/5 · Exploit
• https://osv.dev/vulnerability/CVE-2018-13021 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13021 · Security Note