PT-2021-21285

Name of the Vulnerable Software and Affected Versions Mara version 7.5 Description A remote code execution issue in the /codebase/dir.php?type=filenew component allows attackers to execute arbitrary commands via a crafted PHP file. Recommendations For Mara version 7.5, consider disabling the...

CVE-2020-25042

CVE-2020-25042 concerns Mara CMS 7.5 where an authenticated admin/manager can upload PHP via codebase/handler.php after invoking codebase/dir.php?type=filenew, enabling arbitrary code execution. The vulnerability is triggered by an authenticated session and a crafted request; public exploit detai...

CVE-2020-25042: Unrestricted Upload of File with Dangerous Type

An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated admin/manager session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php...