GHSA-j8jp-9x42-4pj5

ghsaUSosv

Unrestricted Upload of File with Dangerous Type in MODX Revolution

view advisory published 2022-02-27Licence: CC-BY-4.0

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-26149US	high7.2	9.31% (95th)	Exploit	2022-02-26
MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can…

references

External citations — patches, advisories, analysis.

http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.htmlWEB
https://github.com/modxcms/revolutionPACKAGE
https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txtWEB
https://nvd.nist.gov/vuln/detail/CVE-2022-26149ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan