CVE-2018-11340

An unrestricted file upload vulnerability in importuser.cgi in ASUSTOR AS6202T ADM 3.1.0.RFQ3 allows attackers to upload supplied data to a specified filename. This can be used to place attacker controlled code on the file system that is then executed.

• CWE-434

• http://seclists.org/fulldisclosure/2018/May/2Exploit, Mailing List, Third Party Advisory
• https://github.com/mefulton/asustorexploitExploit, Third Party Advisory
• https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitationExploit, Third Party Advisory
• http://seclists.org/fulldisclosure/2018/May/2Exploit, Mailing List, Third Party Advisory
• https://github.com/mefulton/asustorexploitExploit, Third Party Advisory
• https://www.purehacking.com/blog/matthew-fulton/back-to-the-future-asustor-web-exploitationExploit, Third Party Advisory

Published

May 22, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-11332Stored cross-site scripting (XSS) vulnerability in the "Site…
• CVE-2018-11334Windscribe 1.81 creates a named pipe with a NULL DACL that a…
• CVE-2018-11335GVToken Genesis Vision (GVT) is a smart contract running on …
• CVE-2018-11338Intuit Lacerte 2017 for Windows in a client/server environme…
• CVE-2018-11339An XSS issue was discovered in Frappe ERPNext v11.x.x-develo…
• CVE-2018-1134An issue was discovered in Moodle 3.x. Students who submitte…
• CVE-2018-11341Directory traversal in importuser.cgi in ASUSTOR AS6202T ADM…
• CVE-2018-11342A path traversal vulnerability in fileExplorer.cgi in ASUSTO…
• CVE-2018-11343A persistent cross site scripting vulnerability in playlistm…
• CVE-2018-11344A path traversal vulnerability in download.cgi in ASUSTOR AS…
• CVE-2018-11345An unrestricted file upload vulnerability in upload.cgi in A…
• CVE-2018-11346An insecure direct object reference vulnerability in downloa…