CVE-2018-20159 File upload in n/a
An authenticated administrator can achieve remote code execution by uploading a malicious ZIP archive containing a PHP file to the main directory.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2018-20159?
CVE-2018-20159 is a high-severity vulnerability in n/a, published on 15 Dec 2018. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the ".zip" file to be accepted, it must also contain a package.json file.
Weakness: CWE-20
Which versions are affected by CVE-2018-20159?
It affects 1 product.
Products include I-Doit I-Doit.
How do I fix CVE-2018-20159?
No fix has been published for CVE-2018-20159 yet. Limit exposure of the affected software until one is available.
Is CVE-2018-20159 being exploited?
There is no known exploitation of CVE-2018-20159 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in n/a
Sources
Also known as GHSA-rrfh-v8r9-85q4.