nvd-json-data-feeds/CVE-2018/CVE-2018-201xx/CVE-2018-20159.json

{
  "id": "CVE-2018-20159",
  "sourceIdentifier": "cve@mitre.org",
  "published": "2018-12-15T05:29:00.797",
  "lastModified": "2024-11-21T04:00:58.590",
  "vulnStatus": "Modified",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a \".php\" file within a \".zip\" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the \".zip\" file to be accepted, it must also contain a package.json file."
    },
    {
      "lang": "es",
      "value": "i-doit open 1.11.2 permite la ejecuci\u00f3n remota de c\u00f3digo debido a que los archivos ZIP se gestionan de manera incorrecta. Tiene una caracter\u00edstica de subida que permite que un usuario autenticado con el rol de administrador suba archivos arbitrarios al directorio del sitio web principal. Su explotaci\u00f3n est\u00e1 relacionada con la subida de un archivo \".php\" en un archivo \".zip\", debido a que un archivo ZIP es aceptado por /admin/?req=modulesaction=add como plugin y se extrae al directorio principal. Para que el archivo \".zip\" sea aceptado, tambi\u00e9n debe contener un archivo package.json."
    }
  ],
  "metrics": {
    "cvssMetricV30": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "3.0",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "HIGH",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9
      }
    ],
    "cvssMetricV2": [
      {
        "source": "nvd@nist.gov",
        "type": "Primary",
        "cvssData": {
          "version": "2.0",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "baseScore": 6.5,
          "accessVector": "NETWORK",
          "accessComplexity": "LOW",
          "authentication": "SINGLE",
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "availabilityImpact": "PARTIAL"
        },
        "baseSeverity": "MEDIUM",
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "acInsufInfo": false,
        "obtainAllPrivilege": false,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "weaknesses": [
    {
      "source": "nvd@nist.gov",
      "type": "Primary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-20"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:i-doit:i-doit:1.11.2:*:*:*:open:*:*:*",
              "matchCriteriaId": "565356A0-0670-4AF4-BFD5-40F6DE58BF5A"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://pentest.com.tr/exploits/i-doit-CMDB-1-11-2-Remote-Code-Execution.html",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.exploit-db.com/exploits/45957",
      "source": "cve@mitre.org",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ]
    },
    {
      "url": "https://pentest.com.tr/exploits/i-doit-CMDB-1-11-2-Remote-Code-Execution.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ]
    },
    {
      "url": "https://www.exploit-db.com/exploits/45957",
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Exploit",
        "Third Party Advisory",
        "VDB Entry"
      ]
    }
  ]
}