CVE-2018-14911

A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by composing a request for a .txt upload and then changing it to a .php upload. The attacker must have admin access to change the upload_file_ext (aka "Allow upload file suffix") setting, and must use "php,php" in this setting to bypass the "php" restriction.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/yxcmf/ukcms/issues/1	Exploit Issue Tracking Third Party Advisory
https://github.com/yxcmf/ukcms/issues/1	Exploit Issue Tracking Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:ukcms:ukcms:*:*:*:*:*:*:*:*

History

21 Nov 2024, 03:50

Type	Values Removed	Values Added
References	~~() https://github.com/yxcmf/ukcms/issues/1 - Exploit, Issue Tracking, Third Party Advisory~~	() https://github.com/yxcmf/ukcms/issues/1 - Exploit, Issue Tracking, Third Party Advisory

Information

Published : 2018-08-03 19:29

Updated : 2024-11-21 03:50

NVD link : CVE-2018-14911

Mitre link : CVE-2018-14911

CVE.ORG link : CVE-2018-14911

JSON object : View

Products Affected

ukcms

ukcms

CWE

CWE-434

Unrestricted Upload of File with Dangerous Type

{"id": "CVE-2018-14911", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2018-08-03T19:29:00.607", "references": [{"url": "https://github.com/yxcmf/ukcms/issues/1", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://github.com/yxcmf/ukcms/issues/1", "tags": ["Exploit", "Issue Tracking", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-434"}]}], "descriptions": [{"lang": "en", "value": "A file upload vulnerability exists in ukcms v1.1.7 and earlier. The vulnerability is due to the system not strictly filtering the file upload type. An attacker can exploit the vulnerability to upload a script Trojan to admin.php/admin/configset/index/group/upload.html to gain server control by composing a request for a .txt upload and then changing it to a .php upload. The attacker must have admin access to change the upload_file_ext (aka \"Allow upload file suffix\") setting, and must use \"php,php\" in this setting to bypass the \"php\" restriction."}, {"lang": "es", "value": "Existe una vulnerabilidad de subida de archivos en ukcms en versiones 1.1.7 y anteriores. La vulnerabilidad se debe a que el sistema no filtra de forma estricta el tipo de subida de archivos. Un atacante puede explotar la vulnerabilidad para subir un script troyano a admin.php/admin/configset/index/group/upload.html para obtener el control del servidor componiendo una petici\u00f3n para la subida de un archivo .txt y cambi\u00e1ndolo despu\u00e9s a subida .php. El atacante debe tener acceso de administrador para cambiar la opci\u00f3n upload_file_ext (\"Allow upload file suffix\") y debe emplear \"php,php\" en esta opci\u00f3n para omitir la restricci\u00f3n \"php\"."}], "lastModified": "2024-11-21T03:50:04.360", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ukcms:ukcms:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2C702DDF-CCA8-4621-AB18-9F7C49854A2A", "versionEndIncluding": "1.1.7"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}