PT-2019-19877 · Feifei · Feifeicms

Publicado 2019-03-14 · Atualizado 2019-03-19 · CVE-2019-9825

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FeiFeiCMS version 4.1.190209

Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by modifying the set of allowable file extensions through the "Admin-Index" page at the "index.php?s=Admin-Index" endpoint, and then utilizing the "add article" feature to upload malicious PHP code, such as by adding php to the default allowable extensions jpg, gif, png, jpeg.

Recommendations For FeiFeiCMS version 4.1.190209, consider restricting access to the "Admin-Index" page and the "add article" feature until a patch is available, and remove php from the list of allowable file extensions to prevent the upload of malicious PHP code.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-9825

Produtos afetados

Feifeicms

Referências · 4

• 🔥 https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/FeiFeiCMS_4.1_code_execution.doc · Exploit
• https://osv.dev/vulnerability/CVE-2019-9825 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-9825 · Nota de Segurança
• http://blog.whiterabbitxyj.com/cve/FeiFeiCMS_4.1_code_execution.doc · Nota