Design/Logic Flaw

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

Directory traversal

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18830

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18830

MCMS 4.6.5 is affected by a flaw in com\mingsoft\basic\action\web\FileAction.java where the upload interface does not verify login status, allowing an attacker to upload JSP content disguised as a .png file and then coerce a suffix change to .jsp to access a stored path and execute arbitrary JSP ...

CVE-2018-18831

The CVE-2018-18831 issue affects MCMS 4.6.5, specifically in com\mingsoft\cms\action\GeneraterAction.java. An attacker can exploit a directory traversal via the position parameter in the url to write a .jsp file to an arbitrary directory, enabling arbitrary file write. The connected advisories de...

CVE-2018-18830: Unrestricted Upload of File with Dangerous Type

An issue was discovered in com\mingsoft\basic\action\web\FileAction.java in MCMS 4.6.5. Since the upload interface does not verify the user login status, you can use this interface to upload files without setting a cookie. First, start an upload of JSP code with a .png filename, and then intercep...

CVE-2018-18831: Improper Limitation of a Pathname to a Restricted Directory

An issue was discovered in com\mingsoft\cms\action\GeneraterAction.java in MCMS 4.6.5. An attacker can write a .jsp file in the position parameter to an arbitrary directory via a ../ Directory Traversal in the url parameter...

Cross-Site Request Forgery (CSRF)

ms-mcms is vulnerable to cross-site forgery request. An attacker is able to trick an administrator into visiting a malicious HTML page which adds an administrator account on behalf of the victim...

CVE-2018-17366

An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...

Cross site request forgery (csrf)

An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...

CVE-2018-17366

MCMS 4.6.5 is affected by a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do. The CVSS metrics indicate high impact (CVSS‑3.0 base score 8.8, HIGH) with network attack vector and user interaction required. The CVSS‑2 entry is 6.8 (MEDIUM). No exploitation deta...

CVE-2018-17366

An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...

CVE-2018-17366: Cross-Site Request Forgery (CSRF)

An issue was discovered in MCMS 4.6.5. There is a CSRF vulnerability that can add an administrator account via ms/basic/manager/save.do...

Stored Cross-Site Scripting Vulnerability in the Frontend of MCMS (Minfy MS Platform)

MCMS MFMS platform is a content management system that supports different platforms, different terminals and multi-sites, developed by MF Technology Co. A stored cross-site scripting vulnerability exists in the front-end of MCMS MS-MCMS. The vulnerability is due to peopleUserRealName failed to...

mcms最新版SQL注入一枚（可出任意数据）

简要描述： mcms最新版SQL注入一枚（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：POST /app/public/flink.php?m=insertlogo&ajax=1 post中有个参数fimg存在注入。 function minsertlogo global $dbm; $POST'fid' = isset$POST'fid' ? intval$POST'fid' : 0; $POST'fimg'...

mcms最新版SQL注入（可出任意数据）

简要描述： mcms最新版SQL注入（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：POST /app/public/adv.php?m=saveall...

mcms最新版SQL注入漏洞（可出任意数据）

简要描述： mcms最新版SQL注入漏洞（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚： GET /app/public/gov.shop.order.php?m=view&orderid=1（注意public文件夹是安装系统时取的名字）其中orderid没有过滤，直接进行sql执行。 function mview global $dbm,$result,$V,$C,$orderid;...

mcms最新版SQL注入二枚打包（可出任意数据）

简要描述： mcms最新版SQL注入二枚打包（可出任意数据） 详细说明： 掌易科技的程序员反应相当快啊，确认漏洞当天就修复以后出新版本了，前面在wooyun提的几个漏洞新版的mcms做了相应的处理，发布了新版v3.1.3.enterprise，再来研究研究。 注入一枚：/app/public/code.php?codeid=6977&txt=test&value=test（注意public文件夹是安装系统时取的名字）post中有两个参数，都存在过滤不严的问题。 Txt和value都存在注入问题，这里我们以txt为例来证明问题的存在。我们看看是如何注入的。...