What’s Vulnerable › Vulnerabilities

CVE-2017-18048

• Severity: high (CVSS 8.8 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 63.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-01-23 · updated 2026-06-17
• Weakness: CWE-434

Description

Monstra CMS 3.0.4 allows users to upload arbitrary files, which leads to remote command execution on the server, for example because .php (lowercase) is blocked but .PHP (uppercase) is not.

Affected products

• Monstra: 3.0.4

References

• https://blogs.securiteam.com/index.php/archives/3559
• https://github.com/monstra-cms/monstra/issues/426
• https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
• https://www.exploit-db.com/exploits/43348/
• https://blogs.securiteam.com/index.php/archives/3559
• https://github.com/monstra-cms/monstra/issues/426
• https://securityprince.blogspot.in/2017/12/monstra-cms-304-arbitrary-file-upload.html
• https://www.exploit-db.com/exploits/43348/

Get alerted when CVE-2017-18048 or the next vulnerability affects your stack