CVE-2021-37770

HIGH

Nucleus CMS 3.71 - Unrestricted File Upload via Htaccess Manipulation

Title source: llm
STIX 2.1

Description

Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.

References (2)

Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/NucleusCMS/NucleusCMS/issues/96
Exploit, Third Party Advisory x_refsource_misc
https://shimo.im/docs/Ch9CphJt8XwTvQ3d

Scores

CVSS v3 7.2
EPSS 0.0124
EPSS Percentile 65.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE
CWE-434
Status published
Products (1)
nucleuscms/nucleus_cms 3.71
Published Jun 30, 2022
Tracked Since Feb 18, 2026