PT-2018-14639 · Lulu · Lulu Cms

Jackkong1 · Published 2018-10-29 · Updated 2018-12-11 · CVE-2018-18771

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LuLu CMS versions prior to 2015-05-14

Description An issue was discovered that allows arbitrary file upload. This is achieved by entering a filename, directory name, and PHP code into the three text input fields in the backendmodulesfilemanagercontrollersDefaultController.php file.

Recommendations For versions prior to 2015-05-14, restrict access to the backendmodulesfilemanagercontrollersDefaultController.php file to minimize the risk of exploitation. As a temporary workaround, consider disabling the file upload functionality in the DefaultController.php file until a fix is applied.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-18771

Affected Products

Lulu Cms

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2018-18771 · Security Note
• https://osv.dev/vulnerability/CVE-2018-18771 · Vendor Advisory
• https://github.com/yiifans/lulucms/issues/6 · Note