PT-2019-10011 · Rukovoditel · Rukovoditel

Akkus + 1 · Published 2019-01-02 · Updated 2019-01-31 · CVE-2018-20166

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Rukovoditel version 2.3.1

Description: A file-upload issue exists, allowing users to upload PHP content by exploiting a weakness in extension checking. The "index.php?module=configuration/save" endpoint accepts uploads if the first few characters match GIF data and the filename ends in ".php" with mixed case, such as the .pHp extension.

Recommendations: For Rukovoditel version 2.3.1, as a temporary workaround, consider restricting access to the "index.php?module=configuration/save" endpoint to minimize the risk of exploitation. Avoid using this endpoint for file uploads until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2018-20166

Affected Products

Rukovoditel

References · 4

• 🔥 https://pentest.com.tr/exploits/Rukovoditel-Project-Management-CRM-2-3-1-Authenticated-Remote-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/46011 · Exploit
• https://osv.dev/vulnerability/CVE-2018-20166 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-20166 · Security Note