CVE-2020-13978 - CVE House
Back to Database
Status published High CVE-2020-13978

Monstra CMS 3.0.4 allows an attacker, who already has administrative...

Vulnerability Description

Monstra CMS 3.0.4 allows an attacker, who already has administrative access to modify .chunk.php files on the Edit Chunk screen, to execute arbitrary OS commands via the Theme Module by visiting the admin/index.php?id=themes&action=edit_chunk URI. NOTE: there is no indication that the Edit Chunk feature was intended to prevent an administrator from using PHP's exec feature

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-13978

Credits & Attribution

No credits recorded in the NVD database.

References

More from monstra

View All →
CVE-2021-40940
Monstra 3.0.4 does not filter the case of php, which...
Critical 9.8
CVE-2021-36548
A remote code execution (RCE) vulnerability in the component /admin/index.php?id=themes&action=edit_template&filename=blog...
Critical 9.8
CVE-2020-8439
Monstra CMS through 3.0.4 allows remote authenticated users to take...
Medium 6.5
CVE-2020-25414
A local file inclusion vulnerability was discovered in the captcha...
Critical 9.8
CVE-2020-23697
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the...
Medium 5.4

Affected Vendor

Affected Software

monstra cms
Vulnerable Versions:
3.0.4

Timeline

Official Publish: June 9th, 2020
Last Modified: August 27th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

No CWE data available

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.