CVE-2018-6383

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php and similar file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-180...

CVE-2018-6383

Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php and similar file extensions but not the .pht or .phar extension, which allows remote authenticated Admins or Editors to execute arbitrary PHP code by uploading a file, a different vulnerability than CVE-2017-180...

CVE-2018-6383

Monstra CMS

Command injection

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php lowercase is blocked but .PHP uppercase is not...

CVE-2017-18048

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php lowercase is blocked but .PHP uppercase is not...

CVE-2017-18048

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php lowercase is blocked but .PHP uppercase is not...

CVE-2017-18048

Monstra CMS 3.0.4 contains an input-filter bypass in the file-upload feature: the forbidden types list excludes .php while not covering uppercase or related extensions, enabling authenticated admins/editors to upload a PHP payload and trigger remote command execution on the server (CVE-2017-18048...

CVE-2017-18048

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php lowercase is blocked but .PHP uppercase is not...

Monstra CMS Arbitrary File Upload Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in Monstra CMS version 3.0.4. The vulnerability can be exploited by remote...

Monstra CMS 3.0.4 - (Authenticated) Arbitrary File Upload Remote Code Execution

Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload Remote Code Execution Exploit Title: Monstra CMS - 3.0.4 RCE Vendor Homepage: http://monstra.org/ Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip Discovered by: Ishaq Mohammed Contact:...

Monstra CMS 3.0.4 - (Authenticated) Arbitrary File Upload / Remote Code Execution

Exploit Title: Monstra CMS - 3.0.4 RCE Vendor Homepage: http://monstra.org/ Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip Discovered by: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: webapps Platfor...

Monstra CMS 3.0.4 Remote Shell Upload

Exploit Title: Monstra CMS - 3.0.4 RCE Vendor Homepage: http://monstra.org/ Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip Discovered by: Ishaq Mohammed Contact: https://twitter.com/securityprince Website: https://about.me/security-prince Category: webapps Platfor...

Monstra CMS - Remote Code Execution

Monstra CMS - Remote Code Execution. CVE-2017-18048. Webapps exploit for PHP platform Vulnerabilities Summary The following advisory describes a vulnerability found in Monstra CMS. Monstra is “a modern and lightweight Content Management System. It is Easy to install, upgrade and use.” The...

Monstra CMS 3.0.4 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications | | Exploit Title: Monstra cms Cross Site ScriptingXSS | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : http://monstra.org/ | Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip | Version: 3.0.4 ...

Monstra CMS 3.0.4 Cross Site Scripting

| | Exploit Title: Monstra cms Cross Site ScriptingXSS | Exploit Author: Ashiyane Digital security Team | Vendor Homepage : http://monstra.org/ | Software Link: https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip | Version: 3.0.4 | Date: 2017-11-13 | Category: Webapps | Tested on:...

Monstra CMS 3.0.3 - Multiple Vulnerabilities

Monstra CMS 3.0.3 - Multiple Vulnerabilities Exploit Title: Monstra CMS 3.0.3 - Privilege Escalation / Remote Password Change Google Dork: intext:"Powered by Monstra"/users/registration Date: 2016-03-28 Exploit Author: Sarim Kiani Vendor Homepage: http://monstra.org Software Link:...

Monstra CMS 3.0.3 - Multiple Vulnerabilities

Exploit for php platform in category web applications Exploit Title: Monstra CMS 3.0.3 - Privilege Escalation / Remote Password Change Google Dork: intext:"Powered by Monstra"/users/registration Date: 2016-03-28 Exploit Author: Sarim Kiani Vendor Homepage: http://monstra.org Software Link:...

Monstra CMS 3.0.3 - Multiple Vulnerabilities

Exploit Title: Monstra CMS 3.0.3 - Privilege Escalation / Remote Password Change Google Dork: intext:"Powered by Monstra"/users/registration Date: 2016-03-28 Exploit Author: Sarim Kiani Vendor Homepage: http://monstra.org Software Link: http://monstra.org/download Version: 3.0.3 Tested on: Window...

CVE-2014-9006

Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the loginattempts cookie or setting it to certain values...

Design/Logic Flaw

Monstra 3.0.1 and earlier uses a cookie to track how many login attempts have been attempted, which allows remote attackers to conduct brute force login attacks by deleting the loginattempts cookie or setting it to certain values...