CVE-2017-18048

EPSS 63.4%

Vexday Risk Score

30Bajo

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

Madurez del exploit

Exploit funcional

Exploit automatizable disponible (Nuclei/Metasploit).

CVSS —EPSS 63.4%KEV nãoPoC —Nuclei —Metasploit simPatch —

Ciclo de vida

18 dic 2017Exploit Metasploit disponible

23 ene 2018Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

Productos afectados

n/a · n/a

Referencias

https://blogs.securiteam.com/index.php/archives/3559 https://github.com/monstra-cms/monstra/issues/426 https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html https://www.exploit-db.com/exploits/43348/