October CMS - Upload Protection Bypass Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'October CMS Upload Protection Bypass Code Execution', 'Description' = %q This module exploits an Authenticated user with permission to upload and...

CVE-2017-1000119

creationtimestamp| type| source ---|---|--- 2019-09-06 15:22:57+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/octoberuploadbypassexec.rb 2019-09-10 00:00:00+00:00| exploited| https://www.exploit-db.com/exploits/47376...

October CMS Upload Protection Bypass Code Execution

This module exploits an Authenticated user with permission to upload and manage media contents can upload various files on the server. Application prevents the user from uploading PHP code by checking the file extension. It uses black-list based approach, as seen in...

CVE-2017-1000119

October CMS build 412 is vulnerable to PHP code execution via the file upload functionality, potentially allowing site compromise and server-wide impact. The vulnerability is documented across multiple sources (NVD entry CVE-2017-1000119; GitHub/OSV/OSVDB advisories; Metasploit module and exploit...