Grav CMS

Unauthenticated arbitrary file write

Certain versions of Grav CMS be exploited using an unauthenticated arbitrary file write.

Note: scheduler is not enabled by default - will need to be set to replicate this exploit.

GravCMS 1.10.7 - Unauthenticated Arbitrary File Write (Metasploit)Exploit Database

Successful exploit using metasploit 😄