PT-2023-11806 · Unknown · Bloofoxcms

Maxncuo · Published 2023-08-11 · Updated 2023-08-16 · CVE-2020-36082

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions bloofoxCMS version 0.5.2.1

Description The issue allows remote attackers to execute arbitrary code and escalate privileges via a crafted webshell file to the upload module. This can be achieved by uploading a specifically designed file to the vulnerable module, potentially leading to privilege escalation.

Recommendations For bloofoxCMS version 0.5.2.1, consider disabling the file upload feature until a patch is available to prevent remote attackers from executing arbitrary code. Restrict access to the upload module to minimize the risk of exploitation. Avoid using the upload feature with untrusted files or sources until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2020-36082

Affected Products

Bloofoxcms

References · 6

• 🔥 https://github.com/alexlang24/bloofoxCMS/issues/7 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-36082 · Security Note
• https://osv.dev/vulnerability/CVE-2020-36082 · Vendor Advisory
• https://t.me/cibsecurity/68357 · Telegram Post
• https://twitter.com/CVEnew/status/1690264310004477952 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36082 · Note