PT-2021-3361 · Laiketui · Laiketui

Viivyao · Published 2021-06-15 · Updated 2021-06-21 · CVE-2021-34128

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions LaikeTui version 3.5.0

Description The issue allows remote authenticated users to execute arbitrary PHP code by uploading a ZIP archive containing a .php file. This can be achieved by using the "index.php?module=system&action=pay" endpoint to upload the malicious ZIP archive. For example, using the ../../../../phpinfo.php pathname. The vulnerability exists due to insufficient input validation in the ZIP Archive Handler component.

Recommendations For LaikeTui version 3.5.0, consider disabling the module=system&action=pay functionality in the "index.php" endpoint until a patch is available to prevent the upload of malicious ZIP archives. Restrict access to the ZIP Archive Handler component to minimize the risk of exploitation. Avoid using the module and action parameters in the affected endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-20

CWE-434

Related Identifiers

BDU:2021-03199

CVE-2021-34128

Affected Products

Laiketui

References · 5

• 🔥 https://github.com/bettershop/LaikeTui/issues/8 · Exploit
• https://bdu.fstec.ru/vul/2021-03199 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34128 · Security Note
• https://osv.dev/vulnerability/CVE-2021-34128 · Vendor Advisory
• https://vuldb.com/?id.177055 · Note