Description
dotCMS 是一个Java开发的开源且跨平台的功能强大的内容管理系统(CMS)。CVE-2022-26352 中由于 api/content 路径存在未授权文件上传漏洞，攻击者可构造恶意请求上传webshell，从而执行任意代码，控制服务器。
dotCMS api/content 任意文件上传漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://pentest-tools.com/vulnerabilities-exploits/dotcms-arbitrary-file-upload_3189
https://www.rapid7.com/db/modules/exploit/multi/http/dotcms_file_upload_rce/
https://www.sentinelone.com/vulnerability-database/cve-2022-26352/
https://safe.security/resources/blog/dotcms-remote-code-execution/
https://thehackernews.com/2022/05/critical-rce-bug-reported-in-dotcms.html
https://www.assetnote.io/resources/research/advisory-dotcms-remote-code-execution-cve-2022-26352
https://nvd.nist.gov/vuln/detail/CVE-2022-26352
https://avd.aliyun.com/detail?id=AVD-2022-1202752
https://stack.chaitin.com/vuldb/detail/e4b83182-b5d8-4545-8458-f20519bfe212
https://nosec.org/m/share/5007.html