CVE-2018-6383

EPSS 13.5%

Vexday Risk Score

28Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 13.5%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

29 Jan 2018Published on NVD

04 Jun 2021Public PoC

Weaponization speed

1221 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-18048.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencepacketstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.htmlunverified exploitdbwww.exploit-db.com/exploits/49949unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

http://packetstormsecurity.com/files/162968/Monstra-CMS-3.0.4-Remote-Code-Execution.html https://github.com/Hacker5preme/Exploits/tree/main/CVE-2018-6383-Exploit https://github.com/monstra-cms/monstra/issues/429