PT-2018-13709 · Cscms · Cscms

Published 2018-09-08 · Updated 2018-10-30 · CVE-2018-16731

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CScms version 4.1

Description The issue allows for arbitrary file upload. This can be achieved by modifying the default filetype list, which includes gif, jpg, and png, to accept other file types, such as php. An attacker can then specify a .php pathname within fileurl JSON data to upload malicious files.

Recommendations For CScms version 4.1, restrict the file types that can be uploaded to prevent arbitrary file upload. As a temporary workaround, consider disabling the file upload feature until a patch is available. Avoid using the fileurl JSON data to upload files with potentially malicious extensions, such as .php, until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-16731

Affected Products

Cscms

References · 4

• 🔥 https://patec.cn/newsshow.php?cid=24&id=123 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-16731 · Security Note
• https://osv.dev/vulnerability/CVE-2018-16731 · Vendor Advisory
• ❌ https://github.com/AvaterXXX/CScms/blob/master/CScms_up.md · Note, Deleted