Exploitation Summary
EIP tracks 3 public exploits for CVE-2017-1000119.
PoCs published by Metasploit, dugisan3rd, Anti Räis, including Metasploit module exploits/multi/http/october_upload_bypass_exec.
AI-analyzed exploit summary This Metasploit module exploits an authenticated file upload vulnerability in October CMS by bypassing blacklisted file extensions to achieve remote code execution via a malicious PHP file.
Description
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
Exploits (3)
This Metasploit module exploits an authenticated file upload vulnerability in October CMS by bypassing blacklisted file extensions to achieve remote code execution via a malicious PHP file.
This repository contains a functional exploit for CVE-2017-1000119, which targets an upload protection bypass in October CMS leading to remote code execution. The exploit automates authentication, file upload, and command execution via a crafted PHP file.
This Metasploit module exploits an authenticated file upload vulnerability in October CMS by bypassing blacklisted file extensions to achieve remote code execution. It authenticates as a user with media upload permissions, uploads a malicious PHP file, and triggers execution via a GET request.
References (2)
Scores
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H