CVE-2020-25042 File upload in n/a
Authenticated administrators can upload arbitrary PHP files to execute code on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-25042?
CVE-2020-25042 is a high-severity vulnerability in n/a, published on 3 Sep 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
An arbitrary file upload issue exists in Mara CMS 7.5. In order to exploit this, an attacker must have a valid authenticated (admin/manager) session and make a codebase/dir.php?type=filenew request to upload PHP code to codebase/handler.php.
Weakness: CWE-434
Which versions are affected by CVE-2020-25042?
It affects 1 product.
Products include Maracms Maracms.
How do I fix CVE-2020-25042?
No fix has been published for CVE-2020-25042 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-25042 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-25042 exists.
Public exploit code: 1 Metasploit module and 1 proofs of concept on GitHub.
Sources
Also known as GHSA-8h22-fc39-v23w.