CVE-2016-20052 - Vulnerability Analysis

Overview

Snews CMS 1.7 contains an unrestricted file upload vulnerability caused by lack of upload restrictions in the multipart form-data endpoint, letting unauthenticated attackers upload and execute arbitrary PHP files, exploit requires no authentication.

Severity & Score

Impact

Unauthenticated attackers can upload and execute arbitrary PHP files, leading to full remote code execution on the server.

Mitigation

Update to the latest version with upload restrictions or apply patches to restrict file uploads.

References

• https://www.exploit-db.com/exploits/40706
• https://www.vulncheck.com/advisories/snews-cms-unrestricted-file-upload-via-snews-files

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner