PT-2025-51959 · Unknown · Sitemagic Cms

Mirabbas Ağalarov · Published 2025-12-17 · Updated 2025-12-20 · CVE-2023-53921

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SitemagicCMS version 4.4.3

Description The software contains a remote code execution issue that allows attackers to upload malicious PHP files to the 'files/images' directory. An attacker can upload a .phar file containing a system command execution payload to compromise the web application and execute arbitrary system commands. The API endpoint used for file upload is not specified. The vulnerable parameter is not specified. The function responsible for handling file uploads is not specified.

Recommendations Update to a newer version that contains a fix for this vulnerability. As a temporary workaround, restrict file upload permissions to the 'files/images' directory.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2023-53921

Affected Products

Sitemagic Cms

References · 6

• 🔥 https://exploit-db.com/exploits/51464 · Exploit
• https://osv.dev/vulnerability/CVE-2023-53921 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-53921 · Security Note
• https://vulncheck.com/advisories/sitemagiccms-remote-code-execution-via-unrestricted-file-upload · Note
• https://sitemagic.org/Download.html · Note
• https://twitter.com/CVEnew/status/2002487785677348909 · Twitter Post