CVE-2018-20159 - CVE House
Back to Database
Status published High CVE-2018-20159

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives...

Vulnerability Description

i-doit open 1.11.2 allows Remote Code Execution because ZIP archives are mishandled. It has an upload feature that allows an authenticated user with the administrator role to upload arbitrary files to the main website directory. Exploitation involves uploading a ".php" file within a ".zip" file because a ZIP archive is accepted by /admin/?req=modules&action=add as a plugin, and extracted to the main directory. In order for the ".zip" file to be accepted, it must also contain a package.json file.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-20159

Credits & Attribution

No credits recorded in the NVD database.

References

More from i-doit

View All →
CVE-2021-3151
i-doit before 1.16.0 is affected by Stored Cross-Site Scripting (XSS)...
Medium 5.4
CVE-2020-13826
A CSV injection (aka Excel Macro Injection or Formula Injection)...
High 8.8
CVE-2020-13825
A cross-site scripting (XSS) vulnerability in i-doit 1.14.2 allows remote...
Medium 6.1
CVE-2019-6965
An XSS issue was discovered in i-doit Open 1.12 via...
Medium 6.1
CVE-2014-2231
Cross-site scripting (XSS) vulnerability in the API in synetics i-doit...
Medium 4.3

Affected Vendor

Affected Software

i-doit
Vulnerable Versions:
1.11.2

Timeline

Official Publish: December 15th, 2018
Last Modified: September 16th, 2024
Added to House: July 20th, 2026

CVSS Vectors

V3: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.