CVE-2024-40400

CVE-2024-40400 is an arbitrary file upload vulnerability in Automad v2.0.0’s image upload function. The underlying issue allows an attacker to upload a crafted file and execute arbitrary code on the server. CVSSv3.1 base metrics indicate network access, low attack complexity, and required privile...

PT-2024-28828 · Automad · Automad

Name of the Vulnerable Software and Affected Versions: Automad version 2.0.0 Description: An arbitrary file upload vulnerability in the image upload function allows attackers to execute arbitrary code via a crafted file. The malicious file has to be prepared and uploaded manually by the admin,...

CVE-2024-40400

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2024-40400

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file...

CVE-2024-40400

An arbitrary file upload vulnerability in the image upload function of Automad v2.0.0 allows attackers to execute arbitrary code via a crafted file...

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting Vulnerability

Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting XSS Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://automad.org Software Link: https://github.com/marcantondahmen/automad Category: Web Application Flat File CMS Version: 2.0.0-alpha.4 Tested on: Docker version...

Automad 2.0.0-alpha.4 Cross Site Scripting

Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting XSS Date: 20-06-2024 Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://automad.org Software Link: https://github.com/marcantondahmen/automad Category: Web Application Flat File CMS Version: 2.0.0-alpha.4 Tested on:...

Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting (XSS)

Exploit Title: Automad 2.0.0-alpha.4 - Stored Cross-Site Scripting XSS Date: 20-06-2024 Exploit Author: Jerry Thomas w3bn00b3r Vendor Homepage: https://automad.org Software Link: https://github.com/marcantondahmen/automad Category: Web Application Flat File CMS Version: 2.0.0-alpha.4 Tested on:...

Cross Site Request Forgery

automad is vulnerable to Cross Site Request Forgery. The vulnerability is due to improper implementation of CSRF tokens in the User Creation Handler component within the /dashboard?controller=UserCollection::createUser endpoint. This issue can be exploited by an attacker by sending a malicious li...

Unrestricted File Upload

automad is vulnerable to Unrestricted File Upload. The vulnerability is due to insufficient content type checks on file upload within FileCollectionController.php. This issue can be exploited by an attacker via uploading malicious files to the server...

Cross-Site Request Forgery (CSRF) in automad/automad

automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery CSRF. An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly...

Withdrawn Advisory: Unrestricted File Upload affecting automad

Withdrawn Advisory This advisory has been withdrawn because JavaScript execution is the intended functionality of automad. This link is maintained to preserve external references. Original Description A vulnerability was found in automad up to 1.10.9. This affects the function upload of the file...

GHSA-FPPH-MQC8-H6Q5 Withdrawn Advisory: Unrestricted File Upload affecting automad

Withdrawn Advisory This advisory has been withdrawn because JavaScript execution is the intended functionality of automad. This link is maintained to preserve external references. Original Description A vulnerability was found in automad up to 1.10.9. This affects the function upload of the file...

GHSA-Q5Q3-QM26-9JWM Authenticated Blind SSRF in automad/automad

automad up to 1.10.9 is vulnerable to an authenticated blind server-side request forgery in importUrl as the import function on the FileController.php file was not properly validating the value of the importUrl argument. This issue may allow attackers to perform a port scan against the local...

Authenticated Blind SSRF in automad/automad

automad up to 1.10.9 is vulnerable to an authenticated blind server-side request forgery in importUrl as the import function on the FileController.php file was not properly validating the value of the importUrl argument. This issue may allow attackers to perform a port scan against the local...

GHSA-4J8W-P6HV-3QXC Cross-Site Request Forgery (CSRF) in automad/automad

automad up to 1.10.9 does not implement anti-CSRF tokens by default, making it vulnerable Cross-Site Request Forgery CSRF. An attacker may exploit this vulnerability to force an admin into creating or deleting users. An exploit has been disclosed publicly...

CVE-2023-7038

A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may...

Cross site request forgery (csrf)

A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may...

CVE-2023-7038 automad User Creation cross-site request forgery

A vulnerability was found in automad up to 1.10.9. It has been rated as problematic. This issue affects some unknown processing of the file /dashboard?controller=UserCollection::createUser of the component User Creation Handler. The manipulation leads to cross-site request forgery. The attack may...

CVE-2023-7038

Summary: CVE-2023-7038 affects automad up to 1.10.9. The issue is a CSRF vulnerability in the User Creation Handler, specifically processing of the file at /dashboard?controller=UserCollection::createUser. Root cause: automad does not implement anti-CSRF tokens by default, enabling remote exploit...