PT-2018-18799 · Monstra · Monstra Cms

Sunu11 · Published 2018-04-10 · Updated 2018-05-17 · CVE-2018-9037

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4

Description The issue allows remote code execution via an upload file request for a .zip file. This .zip file is automatically extracted and may contain .php files, leading to potential code execution.

Recommendations For Monstra CMS version 3.0.4, consider disabling the upload functionality for .zip files or restricting the types of files that can be uploaded to prevent remote code execution until a patch is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-9037

Affected Products

Monstra Cms

References · 4

• 🔥 https://github.com/monstra-cms/monstra/issues/433 · Exploit
• 🔥 https://exploit-db.com/exploits/44621 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-9037 · Security Note
• https://osv.dev/vulnerability/CVE-2018-9037 · Vendor Advisory