GitHub Advisoryadvisory · Maven

GHSA-c7c7-xm8g-xm36 Unrestricted Upload of File with Dangerous Type in mingsoft:ms-mcms

CRITICAL Published 2018-11-01 Modified 2022-09-14 Official page ↗
Aliases
CVE-2018-18830
Ecosystem
Maven
Packages
net.mingsoft:ms-mcms
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-434
Reviewed
2020-06-16

Affected packages

• Maven net.mingsoft:ms-mcms: <= 4.6.5 (no fix yet)

Description

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.

Related

Alias · CVE (1)

  • CVE-2018-18830 An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. vulnerability

Weakness · CWE (1)

  • CWE-434 Unrestricted Upload of File with Dangerous Type weakness

References