Just a Learner's Blog

Search This Blog

Moved to new space

April 26, 2020

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Hello,

My blogs have been moved to a new space. Do check it out at https://ishaqmohammed.me/posts/

update

Get link
Facebook
Twitter
Pinterest
Email
Other Apps

Comments

CVE-2017-18048 - Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution

Security Advisory: CVE-2017-18048- Monstra CMS 3.0.4 - Arbitrary File Upload / Remote Code Execution OVERVIEW Severity Rating : High Confirmed Affected Versions: 3.0.4 Vendor: MonstraCMS Vendor URL: http://monstra.org/ Vector: Remote Status: Public CVE: CVE-2017-18048 ExploitDB URL: https://www.exploit-db.com/exploits/43348/ SSD Advisory : https://blogs.securiteam.com/index.php/archives/3559 PRODUCT DESCRIPTION Monstra is a modern and lightweight Content Management System. SUMMARY AND IMPACT MonstraCMS 3.0.4 allows users to upload arbitrary files which leads to a remote command execution on the remote server. In MonstraCMS an Editor can upload files to the Monstra CMS and can access them by clicking on them from the administrator portal During this research, I found that the Monstra CMS is allowing an user with editor privileges to upload files forbidding all types of executable files which are mentioned in monstra\plugins\box\filesmanager\fi

One Milestone Completed, More to come...

Finally!! It’s been a year since I officially stepped my foot into the InfoSec world! Keeping all my workload and projects aside, at this point, I wish to pen down everything that my heart pours about this wonderful journey. Looking almost a year back, I see myself as a confused boy who had lost his way towards his goal. Today, had it not been for a few amazing people to guide me through it, I would have been still standing there. Avkash Sir , Neelu Tripathy ma’am and Dhiraj have always showed me the path by giving proper guidance be it related to any InfoSec topic or even my career. I started off by attending the amazing null Mumbai sessions, and as time passed, my passion also grew. Had this been a movie, the award for the best Supporting actor would be given to many, as the entire Null Mumbai team has played a significant role in my life. Along the same time , I was hired as an intern in SecureLayer7 a year ago . I clearly remember my first few months where I was reading

Hello World!!

Hello World!!! I am Ishaq Mohammed

Tweets by security_prince

Powered by Blogger

security_prince

Moved to new space

Comments

Post a Comment