CVE-2018-20159

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the ".zip" file to be accepted, it must also contain a package.json file.

CVSS v3 7.2 HIGH
CVSS v2.0 6.5 MEDIUM

7.2^/10

CVSS v3 : HIGH

Vector : AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://pentest.com.tr/exploits/i-doit-CMDB-1-11-2-Remote-Code-Execution.html	Exploit Third Party Advisory
https://www.exploit-db.com/exploits/45957	Exploit Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

cpe:2.3:a:i-doit:i-doit:1.11.2:*:*:*:open:*:*:*

History

No history.

Information

Published : 2018-12-15 05:29

Updated : 2024-02-04 20:03

NVD link : CVE-2018-20159

Mitre link : CVE-2018-20159

CVE.ORG link : CVE-2018-20159

JSON object : View

Products Affected

i-doit

i-doit

CWE

CWE-20

Improper Input Validation

{"id": "CVE-2018-20159", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2018-12-15T05:29:00.797", "references": [{"url": "https://pentest.com.tr/exploits/i-doit-CMDB-1-11-2-Remote-Code-Execution.html", "tags": ["Exploit", "Third Party Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.exploit-db.com/exploits/45957", "tags": ["Exploit", "Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-20"}]}], "descriptions": [{"lang": "en", "value": "i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a \".php\" file within a \".zip\" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the \".zip\" file to be accepted, it must also contain a package.json file."}, {"lang": "es", "value": "i-doit open 1.11.2 permite la ejecuci\u00f3n remota de c\u00f3digo debido a que los archivos ZIP se gestionan de manera incorrecta. Tiene una caracter\u00edstica de subida que permite que un usuario autenticado con el rol de administrador suba archivos arbitrarios al directorio del sitio web principal. Su explotaci\u00f3n est\u00e1 relacionada con la subida de un archivo \".php\" en un archivo \".zip\", debido a que un archivo ZIP es aceptado por /admin/?req=modulesaction=add como plugin y se extrae al directorio principal. Para que el archivo \".zip\" sea aceptado, tambi\u00e9n debe contener un archivo package.json."}], "lastModified": "2019-01-07T13:46:55.257", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:i-doit:i-doit:1.11.2:*:*:*:open:*:*:*", "vulnerable": true, "matchCriteriaId": "565356A0-0670-4AF4-BFD5-40F6DE58BF5A"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}