Just a Learner's Blog

Search This Blog

Hello World!!

July 31, 2017

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Hello World!!!

I am Ishaq Mohammed

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

CVE-2017-18048 - Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution

Security Advisory: CVE-2017-18048- Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution OVERVIEW Severity Rating : High Confirmed Affected Versions: 3.0.4 Vendor: MonstraCMS Vendor URL: http://monstra.org/ Vector: Remote Status: Public CVE: CVE-2017-18048 ExploitDB URL: https://www.exploit-db.com/exploits/43348/ SSD Advisory : https://blogs.securiteam.com/index.php/archives/3559 PRODUCT DESCRIPTION Monstra is a modern and lightweight Content Management System. SUMMARY AND IMPACT MonstraCMS 3.0.4 allows users to upload arbitrary files which leads to a remote command execution on the remote server. In MonstraCMS an Editor can upload files to the Monstra CMS and can access them by clicking on them from the administrator portal During this research, I found that the Monstra CMS is allowing an user with editor privileges to upload files forbidding all types of executable files which are mentioned in monstra\plugins\box\filesmanager\fi

One Milestone Completed, More to come...

Finally!! It’s been a year since I officially stepped my foot into the InfoSec world! Keeping all my workload and projects aside, at this point, I wish to pen down everything that my heart pours about this wonderful journey. Looking almost a year back, I see myself as a confused boy who had lost his way towards his goal. Today, had it not been for a few amazing people to guide me through it, I would have been still standing there. Avkash Sir , Neelu Tripathy ma’am and Dhiraj have always showed me the path by giving proper guidance be it related to any InfoSec topic or even my career. I started off by attending the amazing null Mumbai sessions, and as time passed, my passion also grew. Had this been a movie, the award for the best Supporting actor would be given to many, as the entire Null Mumbai team has played a significant role in my life. Along the same time , I was hired as an intern in SecureLayer7 a year ago . I clearly remember my first few months where I was reading

CISC (3 Months) - A Stepping Stone for Beginners

Need for Security Information has become the most valuable asset. Over the years, the need for data security has been consistently increasing and thus, many organizations are now taking as much precautions and extra steps to safeguard this valuable information of their clients. It is very important to prevent misuse of critical data of people. Thus information security deals with protecting the confidentiality, integrity, and availability of data from any misuse or malicious activity of hackers. But the question is how to protect the data? Where to acquire skills for becoming an expert in this field? How to get started? About Institute of Information Security The Institute of Information Security (IIS) is a renowned institute which offers many certification courses in Information Security. It includes a variety of training programmes in information security suitable for both beginners, as well as experts. Introduction to CISC (3 Months) Certified Information Secu

Tweets by security_prince

Powered by Blogger

security_prince

Hello World!!

Comments

Post a Comment