CVE-2018-1000094 File upload in n/a
Authenticated administrators can execute arbitrary code on the server by uploading files with malicious extensions via the File Manager.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-1000094?
CVE-2018-1000094 is a high-severity vulnerability in Cmsmadesimple Cms Made Simple, published on 13 Mar 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
CMS Made Simple version 2.2.5 contains a Remote Code Execution vulnerability in File Manager that can result in Allows an authenticated admin that has access to the file manager to execute code on the server. This attack appear to be exploitable via File upload -> copy to any extension.
Weakness: CWE-434
Which versions are affected by CVE-2018-1000094?
It affects 1 product.
Products include Cmsmadesimple Cms Made Simple.
How do I fix CVE-2018-1000094?
No fix has been published for CVE-2018-1000094 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-1000094 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2018-1000094 exists.
Public exploit code: 1 Metasploit module and 1 Exploit-DB entry.
Other vulnerabilities in Cmsmadesimple Cms Made Simple
Sources
Also known as GHSA-h4gq-g24g-w4pf.