Monthly
Unauthenticated file upload in the melis-cms-slider module of Melis Technology's Melis Platform lets remote attackers push a dangerous file through the 'mcsdetail_img' parameter of a POST request to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and, if that file is written into a web-accessible, script-executable directory, obtain remote code execution with the web server's privileges. Both the published CVSS v4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:N) and the independent CVSS v3.1 assessment agree on network reachability, low attack complexity, no required privileges and no user interaction; because the affected route sits inside the CMS back-office, however, some deployments may in practice still require a valid authenticated session, a point that should be confirmed with the vendor or coordinator. Publicly available exploit code exists (a GitHub proof-of-concept) and EPSS is 2.66% (roughly the 85th percentile), but the CVE does not appear in CISA KEV, so active exploitation is not confirmed by the available intelligence.
Unauthenticated file upload in the melis-cms-slider module of Melis Technology's Melis Platform lets remote attackers push a dangerous file through the 'mcsdetail_img' parameter of a POST request to /melis/MelisCmsSlider/MelisCmsSliderDetails/saveDetailsForm and, if that file is written into a web-accessible, script-executable directory, obtain remote code execution with the web server's privileges. Both the published CVSS v4.0 vector (9.3, AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H, SC/SI/SA:N) and the independent CVSS v3.1 assessment agree on network reachability, low attack complexity, no required privileges and no user interaction; because the affected route sits inside the CMS back-office, however, some deployments may in practice still require a valid authenticated session, a point that should be confirmed with the vendor or coordinator. Publicly available exploit code exists (a GitHub proof-of-concept) and EPSS is 2.66% (roughly the 85th percentile), but the CVE does not appear in CISA KEV, so active exploitation is not confirmed by the available intelligence.