EDB-49949

PoC

Monstra CMS 3.0.4 - Remote Code Execution (Authenticated)

view exploit source exploit_dbtype webappsauthor Ron Jostpublished 2021-06-04catalog exploit_db

exploited CVEs (1)

Known CVEs related to this entry.

ID	severity	EPSS	exploitable	published
CVE-2018-6383US	high8.8	13.5% (96th)	Exploit	2018-01-29
Monstra CMS through 3.0.4 has an incomplete "forbidden types" list that excludes .php (and similar) file extensions but not the .pht or .phar extension, which allows remote authent…

scry

Working exploits like this target internet-facing systems. See what is exposed on your perimeter with a free passive scan.