7 matches found
PT-2020-13509
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue allows remote authenticated users to upload and execute arbitrary PHP code. This is possible because the system blocks .php filenames but does not block filenames with certain extensions such as...
CVE-2020-13384: Unrestricted Upload of File with Dangerous Type
Monstra CMS 3.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via admin/index.php?id=filesmanager because, for example, .php filenames are blocked but .php7 filenames are not, a related issue to CVE-2017-18048...
PT-2020-8647
Name of the Vulnerable Software and Affected Versions: Monstra CMS version 1.6 Description: The issue allows for XSS via an uploaded SVG document to the "admin/index.php?id=filesmanager&path=uploads/" URI. It is noted that Monstra CMS is a discontinued product. Recommendations: For Monstra CMS...
CVE-2018-19599: Improper Neutralization of Input During Web Page Generation
Monstra CMS 1.6 allows XSS via an uploaded SVG document to the admin/index.php?id=filesmanager&path=uploads/ URI. NOTE: this is a discontinued product...
PT-2018-14575
Name of the Vulnerable Software and Affected Versions Monstra CMS version 3.0.4 Description The issue concerns stored XSS that can be triggered by remote authenticated administrators. This occurs when a file without an extension is uploaded, and in certain cases, this file is interpreted as...
CVE-2018-18694: Improper Neutralization of Input During Web Page Generation
admin/index.php?id=filesmanager in Monstra CMS 3.0.4 allows remote authenticated administrators to trigger stored XSS via JavaScript content in a file whose name lacks an extension. Such a file is interpreted as text/html in certain cases...
