PT-2018-18799

CVE-2018-9037

·

Publicado

2018-04-10

·

Atualizado

2018-05-17

Descrição por

CVSS 3.1
8.8
Alta
MétricasAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4
Description The issue allows remote code execution via an upload file request for a .zip file. This .zip file is automatically extracted and may contain .php files, leading to potential code execution.
Recommendations For Monstra CMS version 3.0.4, consider disabling the upload functionality for .zip files or restricting the types of files that can be uploaded to prevent remote code execution until a patch is available.
Explorabilidade
Exploit
Correção
Impactos
Pesquisadores
Fornecedores
Produtos afetados
Enumeração de fraquezas
CWE-434: Unrestricted Upload of File with Dangerous Type
Identificadores relacionados
CVE-2018-9037
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com