PT-2023-11503 · Unknown · Semcms Php

Published 2023-06-30 · Updated 2023-07-07 · CVE-2020-18432

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SEMCMS PHP version 3.7

Description The issue allows remote attackers to upload arbitrary files and gain escalated privileges.

Recommendations For SEMCMS PHP version 3.7, update to a version that fixes the file upload issue to prevent remote attackers from uploading arbitrary files and gaining escalated privileges.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-18432

GHSA-HG72-F8X2-CHJH

Affected Products

Semcms Php

References · 5

• https://osv.dev/vulnerability/CVE-2020-18432 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-18432 · Security Note
• https://t.me/cvenotify/53363 · Telegram Post
• https://vorders.me/2019/03/05/semcms-vulnerablity-before-php-v3-7/#admin-upload-webshell-in-SEMCMS-Upfile-php · Note
• https://github.com/advisories/GHSA-hg72-f8x2-chjh · Note