CVE Catalog
CVE-2021-36581
CriticalCVSS 9.8Exploitation Probability (EPSS)
Elevated risk1.43%
70th percentile - higher than 70% of all known CVEs
Summary
Kooboo CMS 2.1.1.0 is vulnerable to insecure file upload. The server does not verify file extensions, allowing an attacker to upload files with .aspx extension.
Risk Assessment
An attacker can upload a malicious executable file (e.g., aspx) to the server, potentially leading to remote code execution and full compromise of the application.
Recommendation
Update Kooboo CMS to the latest version and implement server-side file extension validation, restricting allowed file types.
Original NVD description (English source)
Kooboo CMS 2.1.1.0 is vulnerable to Insecure file upload. It is possible to upload any file extension to the server. The server does not verify the extension of the file and the tester was able to upload an aspx to the server.