HIGH7.2

GHSA-j8jp-9x42-4pj5

Unrestricted Upload of File with Dangerous Type in MODX Revolution

Details

MODX Revolution through 2.8.3-pl allows remote authenticated administrators to execute arbitrary code by uploading an executable file, because the Uploadable File Types setting can be changed by an administrator.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/modx/revolution

Introduced in: 0

No fixed version published yet for modx/revolution (composer). Pin to a known-safe version or switch to an alternative.

References

https://nvd.nist.gov/vuln/detail/CVE-2022-26149[ADVISORY]
https://github.com/modxcms/revolution[PACKAGE]
https://github.com/sartlabs/0days/blob/main/Modx/Exploit.txt[WEB]
http://packetstormsecurity.com/files/171488/MODX-Revolution-2.8.3-pl-Remote-Code-Execution.html[WEB]