GHSA-cwx9-rp4w-4545
Mingsoft MCMS vulnerable to Remote Code Execution via file upload.
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Maven | net.mingsoft:ms-mcms | <= 5.2.5 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Mingsoft MCMS is a Java CMS. Versions prior to and including 5.2.5 contain a file upload vulnerability allowing for a jspx webshell to be uploaded via net.mingsoft.basic.action.web.FileAction#upload, resulting in remote code execution. It is unclear if this issue has been patched.
References
External links from the advisory. They lead to third-party sites.