high7.2Public exploit code
CVE-2020-28337
Zip slip in Microweber
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microweber CMS 1.1.20 - Remote Code Execution (Authenticated)2021-05-10 · webapps · php
Impact
A directory traversal issue in the Utils/Unzip module in Microweber through 1.1.20 allows an authenticated attacker to gain remote code execution via the backup restore feature. To exploit the vulnerability, an attacker must have the credentials of an administrative user, upload a maliciously constructed ZIP file with file paths including relative paths (i.e., ../../), move this file into the backup directory, and execute a restore on this file.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | microweber/microweber | < 1.2.3 | 1.2.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microweber | Microweber | through 1.1.20 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://packetstormsecurity.com/files/162514/Microweber-CMS-1.1.20-Remote-Code-Execution.html
- https://github.com/microweber/microweber/commit/777ee9c3e7519eb3672c79ac41066175b2001b50
- https://sl1nki.page/advisories/CVE-2020-28337
- https://sl1nki.page/blog/2021/02/01/microweber-zip-slip
- https://github.com/advisories/GHSA-pqcf-v8v5-jmcg
- https://nvd.nist.gov/vuln/detail/CVE-2020-28337