PT-2019-19877 · Feifei · Feifeicms

Published 2019-03-14 · Updated 2019-03-19 · CVE-2019-9825

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions FeiFeiCMS version 4.1.190209

Description The issue allows remote attackers to upload and execute arbitrary PHP code. This can be achieved by modifying the set of allowable file extensions through the "Admin-Index" page at the "index.php?s=Admin-Index" endpoint, and then utilizing the "add article" feature to upload malicious PHP code, such as by adding php to the default allowable extensions jpg, gif, png, jpeg.

Recommendations For FeiFeiCMS version 4.1.190209, consider restricting access to the "Admin-Index" page and the "add article" feature until a patch is available, and remove php from the list of allowable file extensions to prevent the upload of malicious PHP code.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-9825

Affected Products

Feifeicms

References · 4

• 🔥 https://github.com/WhiteRabbitc/WhiteRabbitc.github.io/blob/master/cve/FeiFeiCMS_4.1_code_execution.doc · Exploit
• https://osv.dev/vulnerability/CVE-2019-9825 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-9825 · Security Note
• http://blog.whiterabbitxyj.com/cve/FeiFeiCMS_4.1_code_execution.doc · Note