Description
NanoCMS 0.4 contains an authenticated file upload vulnerability that allows remote code execution through unvalidated page content creation. Authenticated attackers can upload PHP files with arbitrary code to the server's pages directory by exploiting the page creation mechanism without proper input sanitization.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| kalyan02 | NanoCMS | 0.4 | — |
References
- ExploitDB-50997 exploit
- NanoCMS GitHub Repository product
- NanoCMS Exploit Archive exploit
- VulnCheck Advisory: NanoCMS 0.4 - Remote Code Execution (RCE) (Authenticated) third-party-advisory