high8.8
CVE-2017-18048
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocke…
Impact
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Monstra | Monstra | Version 3.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blogs.securiteam.com/index.php/archives/3559
- https://github.com/monstra-cms/monstra/issues/426
- https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
- https://www.exploit-db.com/exploits/43348/
- https://blogs.securiteam.com/index.php/archives/3559
- https://github.com/monstra-cms/monstra/issues/426
- https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
- https://www.exploit-db.com/exploits/43348/