PT-2020-16261 · Monocms · Monocms Blog

Published 2020-10-06 · Updated 2020-10-07 · CVE-2020-25987

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MonoCMS Blog version 1.0

Description The issue concerns the storage of hard-coded admin hashes in the log.xml file within the source files of MonoCMS Blog. The hashes are of type bcrypt, and it is possible to use hashcat mode 3200 to crack them.

Recommendations For MonoCMS Blog version 1.0, consider removing or securely storing the hard-coded admin hashes in the log.xml file to prevent unauthorized access. As a temporary workaround, restrict access to the log.xml file to minimize the risk of exploitation.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2020-25987

Affected Products

Monocms Blog

References · 4

• 🔥 http://packetstormsecurity.com/files/159430/MonoCMS-Blog-1.0-File-Deletion-CSRF-Hardcoded-Credentials.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-25987 · Security Note
• https://monocms.com/download · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25987 · Vendor Advisory