Published: 03/10/2018 Updated: 19/11/2018

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8

VMScore: 656

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated malicious users to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.

Vulnerable Product	Search on Vulmon	Subscribe to Product
naviwebs navigate cms 2.8

## # This module requires Metasploit: metasploitcom/download # Current source: githubcom/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ExcellentRanking include Msf::Exploit::Remote::HttpClient def initialize(info = {}) super(update_info(info, 'Name' => 'Navigate CMS Un ...

This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 2.8

Navigate-CMS-RCE -Unauthenticated- This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 28 This script exploits: CVE 2018-17552 # Authentication bypass CVE 2018-17553 # File upload Use Mode wget rawgithubusercontentcom/0x4r2/Navigate-CMS-RCE-Unauthenticated-/main/navigate_RCEsh /navigate_RCEsh navigatorhm

This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 2.8

Navigate-CMS-RCE -Unauthenticated- This module exploits insufficient sanitization in the database::protect method, of Navigate CMS versions 28 This script exploits: CVE 2018-17552 # Authentication bypass CVE 2018-17553 # File upload Use Mode wget rawgithubusercontentcom/0x4r2/Navigate-CMS-RCE-Unauthenticated-/main/navigate_RCEsh /navigate_RCEsh navigatorhm

CVE-2018-17553 PoC

CVE-2018-17553 CVE-2018-17553 PoC (Navigate CMS version 28 and prior) This proof of concept was put together when working on the Black Pearl box from TCM I couldn't find anyone that put out a PoC other than just using Metasploit As I'm avoiding Metasploit in my hacking journey to then go back and do everything all over again with it, I whipped this together quick

CWE-22 CWE-434 https://github.com/rapid7/metasploit-framework/pull/10704 https://github.com/NavigateCMS/Navigate-CMS/commit/2bdcb8b3c5bb23851a2115db96585f1ac8cb2d1e https://www.exploit-db.com/exploits/45561/https://nvd.nist.gov https://github.com/0x4r2/Navigate-CMS-RCE-Unauthenticated-https://www.exploit-db.com/exploits/45561/

CVE-2018-17553

Vulnerability Summary

Vulnerability Trend

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect