CVE-2020-13978 Command injection in n/a
Administrators can execute arbitrary OS commands via the Theme Module's Edit Chunk feature, which allows modifying PHP files.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-13978?
CVE-2020-13978 is a high-severity command injection vulnerability in n/a, published on 9 Jun 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication that the Edit Chunk feature was intended to prevent an administrator from using PHP's exec feature
Weakness: CWE-78
Which versions are affected by CVE-2020-13978?
It affects 1 product.
Products include Monstra Monstra Cms.
How do I fix CVE-2020-13978?
No fix has been published for CVE-2020-13978 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-13978 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-13978 exists.
Other vulnerabilities in n/a
Sources
Also known as GHSA-2cfh-cfhm-pm58.