Product
Remote Code Execution in Grav CMS Flex Objects Plugin
2 rules 6 TTPs 1 CVEAuthenticated users can achieve remote code execution in Grav CMS versions prior to 2.0.13 by exploiting improper input validation in the Flex Objects plugin to upload and execute arbitrary PHP files.
Grav CMS API Blueprint Upload Privilege Escalation
2 rules 1 TTPA low-privileged authenticated API user with `api.media.write` can abuse `/api/v1/blueprint-upload` in Grav CMS to write an arbitrary YAML file into `user/accounts/`, enabling creation of a super-admin account and leading to full administrative compromise of the Grav API.
Grav CMS Privilege De-escalation via User Overwrite
2 rules 2 TTPs 1 IOCA low-privileged user with user creation permissions in Grav CMS can overwrite existing accounts, including the primary administrator, leading to a Denial of Service (DoS) and privilege de-escalation by exploiting a business logic vulnerability in versions prior to 2.0.0-beta.2.