CVE-2018-17418

HIGH

Monstra CMS 3.0.4 - Remote Code Execution via Mixed-Case File Extension Bypass

Title source: llm

Exploitation Summary

EIP tracks 1 public exploit for CVE-2018-17418. PoCs published by Jx0n0.

AI-analyzed exploit summary This PoC demonstrates a file upload vulnerability in Monstra CMS 3.0.4 (CVE-2018-17418) by bypassing blacklist restrictions via case manipulation (e.g., 'PhP' instead of 'php'). The exploit allows arbitrary file upload leading to remote code execution (RCE).

Description

Monstra CMS 3.0.4 allows remote attackers to execute arbitrary PHP code via a mixed-case file extension, as demonstrated by the 123.PhP filename, because plugins\box\filesmanager\filesmanager.admin.php mishandles the forbidden_types variable.

Exploits (1)

nomisec WORKING POC 1 stars

by Jx0n0 · poc

https://github.com/Jx0n0/monstra_cms-3.0.4--getshell

View Code ZIP pw:eip

This PoC demonstrates a file upload vulnerability in Monstra CMS 3.0.4 (CVE-2018-17418) by bypassing blacklist restrictions via case manipulation (e.g., 'PhP' instead of 'php'). The exploit allows arbitrary file upload leading to remote code execution (RCE).

Classification

Working Poc 90%

Attack Type

Rce

Complexity

Trivial

Reliability

Reliable

Target: Monstra CMS 3.0.4

Auth required

Prerequisites: Access to the admin panel · Burp Suite or similar intercepting proxy

MITRE ATT&CK

T1105 - Ingress Tool Transfer T1059 - Command and Scripting Interpreter

devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1

Core References

Exploit, Third Party Advisory x_refsource_misc

https://github.com/AlwaysHereFight/monstra_cms-3.0.4--getshell/blob/master/README.md

View Exploit ZIP pw:eip

Scores

CVSS v3 7.2

EPSS 0.0307

EPSS Percentile 86.0%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-434

Status published

Products (1)

monstra/monstra 3.0.4

Published Mar 07, 2019

Tracked Since Feb 18, 2026