CVEvulnerability
CVE-2018-6383
8.8 HIGH
Official page ↗
- Status
- Modified
- Published
- 2018-01-29
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 8.8 HIGH — CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-184
Description
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.
Affected configurations
• monstra monstra (<= 3.0.4)
Related
Weakness · CWE (1)
- CWE-184 Incomplete List of Disallowed Inputs weakness
References
- http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit Exploit, Third Party Advisory
- https://github.com/monstra-cms/monstra/issues/429 Exploit, Issue Tracking, Third Party Advisory
- http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html Exploit, Third Party Advisory, VDB Entry
- https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit Exploit, Third Party Advisory
- https://github.com/monstra-cms/monstra/issues/429 Exploit, Issue Tracking, Third Party Advisory