The attacker must first obtain administrative access to the platform to use this feature.

The PHP script does not check the extension of the file uploaded by the user, and stores it in a directory accessible by the web server while keeping its extension. Thus, it is possible to upload a PHP script, then execute it by visiting the location where it was uploaded.

Reproduction

This behavior can be reproduced as follows:

We send a .php file containing the code we want to execute on the system. Here, we will execute the system command id.

By observing the response, we can retrieve the file name as it was just written on the server.

To execute our code, simply visit /pmb/temp/[file_name].php with a browser.

The result of the command is returned by the server.

Cause

The cause of this vulnerability is the lack of control over the file before writing it to disk:

Remediation

To remediate this vulnerability, an extension check must be implemented on files uploaded by users.

We recommend using a whitelist system that only allows certain file extensions.

You can also write the file to disk without the extension (knowing that this is temporary storage).

It is also possible to write the file to a directory outside the scope of the web server, which would make the file inaccessible on the Internet, and the code could not be executed.

Versions 7.5.4 and above are not vulnerable; the script has been completely rewritten.