Description
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with shell, treat it as PHP, execute commands, so as to take down website resources.
References (2)
Core 2
Core References
Exploit, Issue Tracking, Third Party Advisory x_refsource_misc
https://github.com/NucleusCMS/NucleusCMS/issues/96
Exploit, Third Party Advisory x_refsource_misc
https://shimo.im/docs/Ch9CphJt8XwTvQ3d
Scores
CVSS v3
7.2
EPSS
0.0107
EPSS Percentile
77.9%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-434
Status
published
Products (1)
nucleuscms/nucleus_cms
3.71
Published
Jun 30, 2022
Tracked Since
Feb 18, 2026