CVE-2018-9156

HIGH Year: 2018
CVSS v3 Score
7.5
High
CVSS v2 Score
7.6
High
Weakness Type
CWE-434
View all →

Vulnerability Description

An issue was discovered on AXIS P1354 (IP camera) Firmware version 5.90.1.1 devices. The upload web page doesn't verify the file type, and an attacker can upload a webshell by making a fileUpload.shtml request for a custom .shtml file, which is interpreted by the Apache HTTP Server mod_include module with "<!--#exec cmd=" support. The file needs to include a specific string to meet the internal system architecture. After the webshell upload, an attacker can use the webshell to perform remote code execution such as running a system command (ls, ping, cat /etc/passwd, etc.). NOTE: the vendor reportedly indicates that this is an intended feature or functionality

Related Vulnerabilities

CVE-2015-9338

HIGH
CVSS:7.5(High)

The wp-file-upload plugin before 2.5.0 for WordPress has insufficient restrictions on upload of .php files.

CWE-4342015

CVE-2015-9339

HIGH
CVSS:7.5(High)

The wp-file-upload plugin before 2.7.1 for WordPress has insufficient restrictions on upload of .js files.

CWE-4342015

CVE-2015-9340

HIGH
CVSS:7.5(High)

The wp-file-upload plugin before 3.0.0 for WordPress has insufficient restrictions on upload of php, js, pht, php3, php4, php5, phtml, htm, html, and htaccess files.

CWE-4342015

CVE-2015-9341

HIGH
CVSS:7.5(High)

The wp-file-upload plugin before 3.4.1 for WordPress has insufficient restrictions on upload of .php.js files.

CWE-4342015

CVE-2016-10958

HIGH
CVSS:7.5(High)

The estatik plugin before 2.3.0 for WordPress has unauthenticated arbitrary file upload via es_media_images[] to wp-admin/admin-ajax.php.

CWE-4342016

CVE-2016-7452

HIGH
CVSS:7.5(High)

The Pixidou Image Editor in Exponent CMS prior to v2.3.9 patch 2 could be used to upload a malicious file to any folder on the site via a cpi directory traversal.

CWE-4342016