CVE-2017-18048

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

Metrics

CVSS 3.0 8.8/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blogs.securiteam.com/index.php/archives/3559Exploit, Third Party Advisory
https://github.com/monstra-cms/monstra/issues/426Patch, Third Party Advisory
https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/43348/Exploit, Third Party Advisory, VDB Entry
https://blogs.securiteam.com/index.php/archives/3559Exploit, Third Party Advisory
https://github.com/monstra-cms/monstra/issues/426Patch, Third Party Advisory
https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.htmlExploit, Third Party Advisory
https://www.exploit-db.com/exploits/43348/Exploit, Third Party Advisory, VDB Entry

Timeline

Published: Jan 23, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017