CVE-2018-13021 File upload in n/a

High 7.2 Published 29 Jun 2018 Updated 5 Aug 2024

Attackers can upload arbitrary script files to execute PHP code via the admin template upload interface.

Exploited in the wild: Not known
Login needed: An administrator
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-13021?

CVE-2018-13021 is a high-severity vulnerability in n/a, published on 29 Jun 2018. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

An issue was discovered in HongCMS 3.0.0. There is an Arbitrary Script File Upload issue that can result in PHP code execution via the admin/index.php/template/upload URI.

Weakness: CWE-434

Which versions are affected by CVE-2018-13021?

It affects 1 product.

Products include Hongcms Project Hongcms.

How do I fix CVE-2018-13021?

No fix has been published for CVE-2018-13021 yet. Limit exposure of the affected software until one is available.

Is CVE-2018-13021 being exploited?

There is no known exploitation of CVE-2018-13021 in the wild and no public exploit code.

Sources

Also known as GHSA-jx5q-p685-xrcc.