PT-2018-12259 · Zeta · Zeta Producer Desktop Cms

P. Morimoto · Published 2018-07-16 · Updated 2018-09-12 · CVE-2018-13981

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Zeta Producer Desktop CMS versions prior to 14.2.1

Description The issue allows for unauthenticated remote code execution due to a default component that permits arbitrary upload of PHP files. This is possible because the formmailer widget blocks .php files but not .php5 or .phtml files, which can be exploited. The vulnerability is related to the /assets/php/formmailer/SendEmail.php and /assets/php/formmailer/functions.php files.

Recommendations For versions prior to 14.2.1, update to version 14.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /assets/php/formmailer/ directory or disabling the formmailer widget until a patch is applied. Avoid using the formmailer widget to handle file uploads until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-13981

Affected Products

Zeta Producer Desktop Cms

References · 5

• 🔥 http://packetstormsecurity.com/files/148537/Zeta-Producer-Desktop-CMS-14.2.0-Code-Execution-File-Disclosure.html · Exploit
• 🔥 https://exploit-db.com/exploits/45016 · Exploit
• 🔥 https://sec-consult.com/en/blog/advisories/remote-code-execution-local-file-disclosure-zeta-producer-desktop-cms · Exploit
• https://osv.dev/vulnerability/CVE-2018-13981 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-13981 · Security Note