CVE-2017-18048 Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.
HighCVSS 8.8
EPSS 61.9%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| monstra | = 3.0.4 | No fix listed |
References
- blogs.securiteam.com exploit third-party-advisory
- github.com patch third-party-advisory
- securityprince.blogspot.in exploit third-party-advisory
- 43348 exploit third-party-advisory vdb-entry