PT-2018-14383 · Bage · Bagecms

Published 2018-10-11 · Updated 2018-11-29 · CVE-2018-18257

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions BageCMS version 3.1.3

Description An issue was discovered that allows an attacker to delete any files and folders on the web server via a directory traversal attack using specific URI requests, such as index.php?r=admini/template/batch&command=deleteFile&fileName= or index.php?r=admini/template/batch&command=deleteFolder&folderName=../.

Recommendations For BageCMS version 3.1.3, consider restricting access to the index.php endpoint with r=admini/template/batch and parameters command and fileName or folderName to prevent unauthorized file and folder deletion until a patch is available.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-18257

Affected Products

Bagecms

References · 3

• 🔥 https://github.com/rakjong/vuln/blob/master/Bagecms_vuln_2.pdf · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-18257 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18257 · Vendor Advisory