CVE-2017-18048 | BDVDB-2026-95658 Detail

Description#

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

Impact#

No impact statement in the source data.

Weaknesses#

No weakness recorded in the source data.

References#

https://github.com/monstra-cms/monstra/issues/426
https://www.exploit-db.com/exploits/43348/
https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
https://blogs.securiteam.com/index.php/archives/3559

Exploit#

https://www.exploit-db.com/exploits/43348/

History#

Version 12018-01-23Record published in the CVE List.
Version 22024-08-05Most recent update recorded in the CVE List.