Description
October CMS build 412 is vulnerable to PHP code execution in the file upload functionality resulting in site compromise and possibly other applications on the server.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
October CMS Upload Protection Bypass Code Execution
exploit/multi/http/october_upload_bypass_exec
Exploit-DB 1
- October CMS - Upload Protection Bypass Code Execution (Metasploit) EDB-47376 · remote · Sep 10, 2019 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | october/cms | <= 1.0.412 | — | GHSA-q263-j3q9-g964 |