> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/kashz-jewels/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/kashz-jewels/services/monstra-cms.md).

# monstra cms

## Interesting Paths

```aspnet
# admin path
/admin/

# db file
/storage/database/users.table.xml
```

## User Cred exposure (unauthenticated)

```
# db file path:
/storage/database/users.table.xml

https://simpleinfosec.com/2018/05/27/monstra-cms-3-0-4-unauthenticated-user-credential-exposure/
```

## File Upload (authenticated)

v 3.0.4

```
https://www.exploit-db.com/exploits/48479
```