PT-2018-17521 · Monstra · Monstra Cms

Hexifeo · Published 2018-01-29 · Updated 2022-02-10 · CVE-2018-6383

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monstra CMS versions prior to 3.0.5

Description The issue is related to an incomplete list of forbidden file types, allowing remote authenticated Admins or Editors to execute arbitrary PHP code by uploading files with certain extensions, such as .pht or .phar.

Recommendations For Monstra CMS versions prior to 3.0.5, update to version 3.0.5 or later to resolve the issue. As a temporary workaround, consider restricting file uploads to only necessary extensions and disabling the ability for Admins or Editors to upload files with .pht or .phar extensions.

Exploit

Fix

Incomplete List of Disallowed Inputs

Weakness Enumeration

CWE-184

Related Identifiers

CVE-2018-6383

Affected Products

Monstra Cms

References · 7

• 🔥 https://github.com/monstra-cms/monstra/issues/429 · Exploit
• 🔥 https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit · Exploit
• 🔥 http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/49949 · Exploit
• https://osv.dev/vulnerability/CVE-2018-6383 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-6383 · Security Note
• https://t.me/cvenotify/15840 · Telegram Post