CVE-2018-16370

CRITICAL

Pescms Team - Unrestricted File Upload

Title source: rule

Description

In PESCMS Team 2.2.1, attackers may upload and execute arbitrary PHP code through /Public/?g=Team&m=Setting&a=upgrade by placing a .php file in a ZIP archive.

Exploits (1)

nomisec WRITEUP

by snappyJack · poc

https://github.com/snappyJack/CVE-2018-16370

View Code ZIP pw:eip

References (1)

[Exploit, Third Party Advisory] https://github.com/lazyphp/PESCMS-TEAM/issues/2

Scores

CVSS v3 9.8

EPSS 0.0128

EPSS Percentile 79.6%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

pescms/pescms_team 2.2.1

Published Sep 03, 2018

Tracked Since Feb 18, 2026