PT-2018-6638 · Monstra · Monstra Cms

Security-Prince · Published 2018-01-23 · Updated 2021-06-08 · CVE-2017-18048

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Monstra CMS version 3.0.4

Description: The issue allows users to upload arbitrary files, leading to remote command execution on the server. This is possible because the system blocks files with .php (lowercase) extensions but does not block files with .PHP (uppercase) extensions, allowing for potential exploitation.

Recommendations: For Monstra CMS version 3.0.4, consider restricting or disabling file upload functionality until a proper fix is available, and ensure that the system properly handles file extensions in a case-insensitive manner to prevent exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2017-18048

Affected Products

Monstra Cms

References · 10

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/monstra_fileupload_exec.rb · Exploit
• 🔥 https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html · Exploit
• 🔥 https://exploit-db.com/exploits/43348 · Exploit
• 🔥 https://blogs.securiteam.com/index.php/archives/3559 · Exploit
• https://github.com/monstra-cms/monstra/issues/426 · Patch
• https://osv.dev/vulnerability/CVE-2017-18048 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-18048 · Security Note
• https://t.me/cvenotify/4008 · Telegram Post
• https://t.me/cibsecurity/12304 · Telegram Post
• https://t.me/cvenotify/15840 · Telegram Post