GHSA-cwx9-rp4w-4545

ghsaUSosv

Mingsoft MCMS vulnerable to Remote Code Execution via file upload.

view advisory published 2022-01-27Licence: CC-BY-4.0

Mingsoft MCMS is a Java CMS. Versions prior to and including 5.2.5 contain a file upload vulnerability allowing for a jspx webshell to be uploaded via net.mingsoft.basic.action.web.FileAction#upload, resulting in remote code execution. It is unclear if this issue has been patched.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-46386US	critical9.8	3.11% (88th)	—	2022-01-26
File upload vulnerability in mingSoft MCMS through 5.2.5, allows remote attackers to execute arbitrary code via a crafted jspx webshell to net.mingsoft.basic.action.web.FileAction#…

references

External citations — patches, advisories, analysis.

https://gitee.com/mingSoft/MCMSPACKAGE
https://gitee.com/mingSoft/MCMS/issues/I4R0GWWEB
https://github.com/ming-soft/MCMSWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-46386ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan