PT-2018-18799

CVE-2018-9037

·

Published

2018-04-10

·

Updated

2018-05-17

Description by

CVSS 3.1
8.8
High
MetricsAV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4
Description The issue allows remote code execution via an upload file request for a .zip file. This .zip file is automatically extracted and may contain .php files, leading to potential code execution.
Recommendations For Monstra CMS version 3.0.4, consider disabling the upload functionality for .zip files or restricting the types of files that can be uploaded to prevent remote code execution until a patch is available.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Weakness enumeration
CWE-434: Unrestricted Upload of File with Dangerous Type
Related identifiers
CVE-2018-9037
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com