PT-2019-19331 · Sitemagic · Sitemagic Cms

Published 2019-02-23 · Updated 2024-08-04 · CVE-2019-9042

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Sitemagic CMS version 4.4

Description An issue in the index.php?SMExt=SMFiles URI allows users to upload .php files, potentially executing arbitrary code, as shown with 404.php. This issue can only occur if the administrator fails to set the FileExtensionFilter and if there are untrusted user accounts. The maintainer considers this a feature for use with External Modules rather than a vulnerability.

Recommendations For Sitemagic CMS version 4.4, set the FileExtensionFilter to prevent untrusted users from uploading executable files. Ensure that only trusted users have access to the system to minimize the risk of exploitation. As a temporary workaround, consider restricting access to the index.php?SMExt=SMFiles URI until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-9042

Affected Products

Sitemagic Cms

References · 4

• 🔥 http://iwantacve.cn/index.php/archives/116 · Exploit
• https://osv.dev/vulnerability/CVE-2019-9042 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9042 · Security Note
• https://t.me/cvenotify/89063 · Telegram Post