PT-2021-10915 · Beescms · Beescms

R0Both · Published 2021-11-08 · Updated 2021-11-13 · CVE-2020-23572

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions BEESCMS version 4.0

Description The issue allows attackers to execute arbitrary code via a crafted image file. This is achieved through an arbitrary file upload vulnerability in the /admin/upload.php component.

Recommendations For BEESCMS version 4.0, consider disabling the /admin/upload.php component until a patch is available to prevent exploitation of the arbitrary file upload vulnerability. Restrict access to this component to minimize the risk of arbitrary code execution.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-23572

Affected Products

Beescms

References · 4

• 🔥 https://github.com/source-trace/beescms/issues/6 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-23572 · Security Note
• https://osv.dev/vulnerability/CVE-2020-23572 · Vendor Advisory
• https://t.me/cibsecurity/32021 · Telegram Post