CVE-2017-18048

This exploit demonstrates a file upload vulnerability in Monstra CMS 3.0.4, allowing arbitrary PHP file uploads leading to remote command execution. The vulnerability stems from incomplete file extension validation, permitting uppercase or alternative PHP extensions to bypass restrictions.

This Metasploit module exploits an authenticated arbitrary file upload vulnerability in Monstra CMS 3.0.4, allowing remote command execution via a malicious PHP file upload. It includes authentication, CSRF token handling, and payload execution.