GHSA-j8jp-9x42-4pj5

Unrestricted Upload of File with Dangerous Type in MODX Revolution

Source: GitHub Advisory Database (reviewed) High CVE-2022-26149

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	modx/revolution	<= 2.8.3-pl	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2022-26149 advisory
https://github.com/modxcms/revolution package
https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt web
http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html web