PT-2024-22868 · Mozilocms · Mozilocms

Published 2024-04-22 · Updated 2024-11-05 · CVE-2024-29368

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions moziloCMS version 2.0

Description The issue allows attackers to bypass file upload restrictions, potentially leading to unauthorized file execution or storage of malicious content. This is achieved by renaming files, which can result in the execution of arbitrary code when a crafted POST request is sent.

Recommendations For moziloCMS version 2.0, consider disabling the file handling module until a patch is available to prevent exploitation. Restrict access to the file upload functionality to minimize the risk of malicious file uploads. Avoid using the file renaming feature in the file handling module until the issue is resolved.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2024-29368

Affected Products

Mozilocms

References · 7

• 🔥 https://github.com/becpn/mozilocms · Exploit
• https://osv.dev/vulnerability/CVE-2024-29368 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29368 · Security Note
• https://t.me/cvenotify/100701 · Telegram Post
• https://t.me/cvenotify/77698 · Telegram Post
• https://t.me/cvenotify/77748 · Telegram Post
• https://t.me/cvenotify/77775 · Telegram Post