Skip to main content

Just a Learner's Blog

Search This Blog

Moved to new space

Get link
Facebook
X
Pinterest
Email
Other Apps

Hello,

My blogs have been moved to a new space. Do check it out at https://ishaqmohammed.me/posts/

update

Get link
Facebook
X
Pinterest
Email
Other Apps

Comments

Post a Comment

Popular Posts

CVE-2017-18048 - Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution

Security Advisory: CVE-2017-18048- Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution OVERVIEW Severity Rating : High Confirmed Affected Versions: 3.0.4 Vendor: MonstraCMS Vendor URL: http://monstra.org/ Vector: Remote Status: Public CVE: CVE-2017-18048 ExploitDB URL: https://www.exploit-db.com/exploits/43348/ SSD Advisory : https://blogs.securiteam.com/index.php/archives/3559 PRODUCT DESCRIPTION Monstra is a modern and lightweight Content Management System. SUMMARY AND IMPACT MonstraCMS 3.0.4 allows users to upload arbitrary files which leads to a remote command execution on the remote server. In MonstraCMS an Editor can upload files to the Monstra CMS and can access them by clicking on them from the administrator portal During this research, I found that the Monstra CMS is allowing an user with editor privileges to upload files forbidding all types of executable files which are...

CVE-2017-15284 - OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting

Security Advisory: CVE-2017-15284 - OctoberCMS 1.0.425 (Build 425) - Cross-Site Scripting OVERVIEW Severity Rating : High Confirmed Affected Versions: 1.0.425 (aka Build 425) Confirmed Patched Versions: Build 426 Vendor: OctoberCMS Vendor URL: https://octobercms.com/ Vector: Remote Status: Public CVE: CVE-2017-15284 ExploitDB URL: https://www.exploit-db.com/exploits/42978/ PRODUCT DESCRIPTION October is a free, open-source, self-hosted CMS platform based on the Laravel PHP Framework. A simple and modular CMS that grows with you, with a precise and beautiful interface that comes as second nature. OctoberCMS is developed and maintained by Alexey Bobkov and Samuel Georges SUMMARY AND IMPACT Cross-Site Scripting exists in OctoberCMS 1.0.425 (aka Build 425), allowing a least privileged user to upload an SVG file containing malicious code as the Avatar for the profile. When this is opened by the Admin, it causes JavaScript execution...

CVE-2017-16807 - Kirby CMS < 2.5.7 - Cross-Site Scripting

Security Advisory: CVE-2017-16807 - Kirby CMS < 2.5.7 - Cross-Site Scripting OVERVIEW Severity Rating : High Confirmed Affected Versions: 2.5.6 Confirmed Patched Versions: 2.5.7 Vendor: KirbyCMS Vendor URL: https://getkirby.com/ Vector: Remote Status: Public CVE: CVE-2017-16807 ExploitDB URL: https://www.exploit-db.com/exploits/43140/ KirbyCMS Advisory : https://getkirby.com/changelog/kirby-2-5-7 PRODUCT DESCRIPTION Kirby is a file‑based CMS. Easy to setup. Easy to use. Flexible as hell. SUMMARY AND IMPACT A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file. In Kirby an Editor has the privilege to upload certain files to the website, however, he can also upload a Scalable Vector Graphics (SVG) files. During this research I found that we can execute JavaScript code via...

Tweets by security_prince

Powered by Blogger

security_prince