CVE-2018-20159

Severity: high (CVSS 7.2 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 9.9% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2018-12-15 · updated 2026-06-17
Weakness: CWE-20

Description

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the ".zip" file to be accepted, it must also contain a package.json file.

Affected products

I-Doit doit CMDB: 1.11.2

References

https://pentest.com.tr/exploits/i-doit-CMDB-1-11-2-Remote-Code-Execution.html
https://www.exploit-db.com/exploits/45957
https://pentest.com.tr/exploits/i-doit-CMDB-1-11-2-Remote-Code-Execution.html
https://www.exploit-db.com/exploits/45957

Get alerted when CVE-2018-20159 or the next vulnerability affects your stack