← Zuruck zu CVEs

CVE-2020-37023

HIGH

8.8

Beschreibung

Koken CMS 0.22.24 contains a file upload vulnerability that allows authenticated attackers to bypass file extension restrictions by renaming malicious PHP files. Attackers can upload PHP files with system command execution capabilities by manipulating the file upload request through a web proxy and changing the file extension.

CVE Details

CVSS v3.1 Bewertung8.8

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatLOW

Erforderliche PrivilegienLOW

BenutzerinteraktionNONE

Veroffentlicht1/30/2026

Zuletzt geandert2/4/2026

Quellenvd

Honeypot-Sichtungen0

Schwachen (CWE)

CWE-434

Referenzen

http://koken.me/(disclosure@vulncheck.com)

https://github.com/V1n1v131r4/Bypass-File-Upload-on-Koken-CMS/blob/master/README.md(disclosure@vulncheck.com)

https://www.exploit-db.com/exploits/48706(disclosure@vulncheck.com)

https://www.softaculous.com/apps/cms/Koken(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/koken-cms-arbitrary-file-upload(disclosure@vulncheck.com)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.