CVE-2018-14911

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by composing a request for a .txt upload and then changing it to a .php upload. The attacker must have admin access to change the upload_file_ext (aka "Allow upload file suffix") setting, and must use "php,php" in this setting to bypass the "php" restriction.

Metrics

CVSS 3.0 7.2/10CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

No affected versions have been published.

Timeline

Published: Aug 3, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-149127.5cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when `enable-http-clone=1` is not turned off, as demonstrate CVE-2018-149169.1LOYTEC LGATE-902 6.3.2 devices allow Arbitrary file deletion.CVE-2018-149187.5LOYTEC LGATE-902 6.3.2 devices allow Directory Traversal.CVE-2018-149196.1LOYTEC LGATE-902 6.3.2 devices allow XSS.CVE-2018-14926.8IBM Jazz Foundation products could allow a user with physical access to the system to log in as another user due to the server's failure to CVE-2018-149226.1Multiple cross-site scripting (XSS) vulnerabilities in Monstra CMS 3.0.4 allow remote attackers to inject arbitrary web script or HTML via t CVE-2018-149237.8A vulnerability in uniview EZPlayer 1.0.6 could allow an attacker to execute arbitrary code on a targeted system via video playback.CVE-2018-149246.1Matera Banco 1.0.0 is vulnerable to multiple stored XSS, as demonstrated by the sca/privilegio/consultarUsuario.jsf "Nome Completo" (aka use CVE-2018-149259.8Matera Banco 1.0.0 mishandles Java errors in the backend, as demonstrated by a stack trace revealing use of net.sf.acegisecurity components.CVE-2018-149268.8Matera Banco 1.0.0 allows CSRF, as demonstrated by a /contingency/web/messageSend/messageSendHandler.jsp request.CVE-2018-149275.3Matera Banco 1.0.0 is vulnerable to path traversal (allowing access to system files outside the default application folder) via the /conting CVE-2018-149287.5/contingency/servlet/ServletFileDownload executes as root and provides unauthenticated access to files via the file parameter.