vendor:
appRain CMF
by:
Ahmet Ümit BAYRAM
8.1
CVSS
CRITICAL
Remote Code Execution (RCE)
918
CWE
Product Name: appRain CMF
Affected Version From: 4.0.5
Affected Version To: latest
Patch Exists: NO
Related CWE: CVE-2024-XXXX
CPE: a:apprain:cmf:4.0.5
Other Scripts:
https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/http/prtg_authenticated_rce, https://www.infosecmatter.com/nessus-plugin-library/?id=18405, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/backupexec/ssl_uaf, https://www.infosecmatter.com/why-your-exploit-completed-but-no-session-was-created-try-these-fixes/, https://www.infosecmatter.com/metasploit-module-library/?mm=auxiliary/admin/networking/cisco_asa_extrabacon, https://www.infosecmatter.com/metasploit-module-library/?mm=exploit/windows/local/nscp_pe
Platforms Tested: MacOS
2024
appRain CMF 4.0.5 – Remote Code Execution (RCE) (Authenticated)
The appRain CMF 4.0.5 allows remote attackers to execute arbitrary code via an authenticated user uploading a crafted file containing PHP code.
Mitigation:
Ensure input validation on file uploads to prevent execution of arbitrary code. Additionally, restrict file upload types to only allow safe file formats.