PT-2019-12312 · Cutephp · Cutenews

Akkus + 1 · Published 2019-04-22 · Updated 2020-09-11 · CVE-2019-11447

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions CutePHP CuteNews version 2.1.2

Description An issue allows an attacker to infiltrate the server through the avatar upload process in the profile area via the "index.php?mod=main&opt=personal" endpoint, by exploiting the avatar file field. The lack of effective control of $imgsize in /core/modules/dashboard.php enables an attacker to change the header content of a file, bypass controls, and potentially achieve code execution, for example, by using a GIF header.

Recommendations For CutePHP CuteNews version 2.1.2, consider disabling the avatar upload feature in the profile area until a patch is available to prevent exploitation through the avatar file field in the "index.php?mod=main&opt=personal" endpoint. Restrict access to the /core/modules/dashboard.php module to minimize the risk of exploitation related to the $imgsize variable.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-11447

Affected Products

Cutenews

References · 8

• 🔥 https://github.com/thewhiteh4t/cve-2019-11447 · Exploit
• 🔥 https://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html · Exploit
• 🔥 https://exploit-db.com/exploits/46698 · Exploit
• 🔥 http://pentest.com.tr/exploits/CuteNews-2-1-2-Remote-Code-Execution-Metasploit.html · Exploit
• 🔥 https://exploit-db.com/exploits/48800 · Exploit
• https://osv.dev/vulnerability/CVE-2019-11447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-11447 · Security Note
• http://packetstormsecurity.com/files/159134/CuteNews-2.1.2-Remote-Code-Execution.html · Note