PT-2023-11544 · Ebcms · Ebcms

Macchiatto725 · Published 2023-06-20 · Updated 2024-12-11 · CVE-2020-20067

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ebCMS version 1.1.0

Description The issue allows a remote attacker to execute arbitrary code via the upload type parameter. This enables the attacker to potentially gain control over the system, leading to unauthorized access and malicious activities.

Recommendations For ebCMS version 1.1.0, consider restricting access to the file upload feature until a patch is available. As a temporary workaround, avoid using the upload type parameter in the affected API endpoint.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-20067

Affected Products

Ebcms

References · 4

• 🔥 https://github.com/a932278490/ebcms/issues/1 · Exploit
• https://osv.dev/vulnerability/CVE-2020-20067 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-20067 · Security Note
• https://t.me/cibsecurity/65363 · Telegram Post