PT-2018-14711 · Minicms · Minicms

Published 2018-11-01 · Updated 2018-12-03 · CVE-2018-18890

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10

Description The issue allows for full path disclosure through the "/mc-admin/post.php" endpoint with specific parameters, such as state set to "delete" and delete set to an invalid filename.

Recommendations For MiniCMS version 1.10, as a temporary workaround, consider restricting access to the "/mc-admin/post.php" endpoint until a patch is available. Additionally, validate and sanitize the delete parameter to prevent disclosure of sensitive information.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2018-18890

Affected Products

Minicms

References · 4

• 🔥❌ https://github.com/AvaterXXX/MiniCms/blob/master/Authentication%20and%20Information%20Exposure.md#information-exposure · Exploit, Deleted
• 🔥 https://patec.cn/newsshow.php?cid=24&id=135 · Exploit
• https://osv.dev/vulnerability/CVE-2018-18890 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-18890 · Security Note