CVEvulnerability
CVE-2017-18048
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-01-23
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-434
Description
Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.
Affected configurations
• monstra monstra 3.0.4
Related
Weakness · CWE (1)
- CWE-434 Unrestricted Upload of File with Dangerous Type weakness
References
- https://blogs.securiteam.com/index.php/archives/3559 Exploit, Third Party Advisory
- https://github.com/monstra-cms/monstra/issues/426 Patch, Third Party Advisory
- https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/43348/ Exploit, Third Party Advisory, VDB Entry
- https://blogs.securiteam.com/index.php/archives/3559 Exploit, Third Party Advisory
- https://github.com/monstra-cms/monstra/issues/426 Patch, Third Party Advisory
- https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/43348/ Exploit, Third Party Advisory, VDB Entry