vendor:
MoziloCMS
by:
Secfortress
6.1
CVSS
HIGH
Arbitrary File Upload
434
CWE
Product Name: MoziloCMS
Affected Version From: 3
Affected Version To: 3
Patch Exists: NO
Related CWE: CVE-2024-44871
CPE: a:mozilo:mozilocms:3.0
Platforms Tested: Debian
2024
MoziloCMS 3.0 – Remote Code Execution (RCE)
MoziloCMS version 3.0 has an arbitrary file upload vulnerability in '/admin/index.php'. An authenticated attacker can upload a malicious .JPG file, rename it to .PHP using the application's function, leading to arbitrary code execution on the 'Files' session.
Mitigation:
To mitigate this vulnerability, ensure proper input validation and file type verification on file uploads. Regularly update to the latest version of MoziloCMS to patch known security issues.
