CVE-2021-36582

Name of the Vulnerable Software and Affected Versions Kooboo CMS version 2.1.1.0

Description The issue allows an attacker to upload a remote shell, such as an aspx file, to the server. The uploaded files are stored in the /Content/Template/root/ directory, for example, reverse-shell.aspx. An attacker can trigger the uploaded shell by simply browsing to its URL, potentially leading to a reverse shell from the victim server.

Recommendations For Kooboo CMS version 2.1.1.0, consider restricting access to the /Content/Template/root/ directory to prevent unauthorized file uploads. As a temporary workaround, avoid using the URL /Content/Template/root/reverse-shell.aspx until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.