### [CVE-2018-18925](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-18925)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Gogs 0.11.66 allows remote code execution because it does not properly validate session IDs, as demonstrated by a ".." session-file forgery in the file session provider in file.go. This is related to session ID handling in the go-macaron/session code for Macaron.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon
- https://github.com/ARPSyndicate/kenzer-templates
- https://github.com/DarkFunct/CVE_Exploits
- https://github.com/Drakfunc/CVE_Exploits
- https://github.com/SexyBeast233/SecBooks
- https://github.com/Threekiii/Awesome-POC
- https://github.com/Threekiii/Vulhub-Reproduce
- https://github.com/Timirepo/CVE_Exploits
- https://github.com/alphaSeclab/sec-daily-2019
- https://github.com/bakery312/Vulhub-Reproduce
- https://github.com/cokeBeer/go-cves
- https://github.com/j4k0m/CVE-2018-18925
- https://github.com/jas502n/Gogs_RCE
- https://github.com/sonatype-nexus-community/nancy