CVE-2018-18830
CRITICALMCMS 4.6.5 - Unauthenticated Arbitrary File Upload via FileAction.java
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2018-18830. PoCs published by mingSoft.
AI-analyzed exploit summary The writeup describes an unauthorized file upload vulnerability in MCMS where the upload interface lacks authentication checks, allowing attackers to upload malicious files (e.g., JSP webshells) by manipulating the file extension in the request. The attack involves intercepting and modifying the 'name' parameter to bypass restrictions.
Description
An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercept the data packet. In the name parameter, change the suffix to jsp. In the response, the server returns the storage path of the file, which can be accessed to execute arbitrary JSP code.
Exploits (1)
The writeup describes an unauthorized file upload vulnerability in MCMS where the upload interface lacks authentication checks, allowing attackers to upload malicious files (e.g., JSP webshells) by manipulating the file extension in the request. The attack involves intercepting and modifying the 'name' parameter to bypass restrictions.
References (1)
Scores
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H