Vulnerable CKEditor used on version 4.2.9 in admidio/admidio
Valid
Reported on
Jun 28th 2023
Description
When attaching image on mail feature, the upload using ckeditor vulnerable version that lead to RCE.
Proof of Concept
- Go to messages,
- Write email
- add image
- Upload the php file.
- access the uploaded php file in /adm_my_files/mail/images/
// PoC.js
Content-Disposition: form-data; name="upload"; filename="aaa.test.php" Content-Type: image/jpeg
<?php phpinfo(); ?>
Impact
Remote code execution
We are processing your report and will contact the
admidio
team within 24 hours.
3 months ago
We have contacted a member of the
admidio
team and are waiting to hear back
3 months ago
Sorry I was just now able to look for your report. Thanks for your research!
Ok, you are able to create a file with php code but in a default configuration you have not access to the folder adm_my_files directly, so you are not able to execute that file. So I changed the availability to low.
The researcher has received a minor penalty to their credibility for miscalculating the severity: -1
The researcher's credibility has increased: +7
Markus Faßbender
has been awarded the fix bounty
This vulnerability has been assigned a CVE
This vulnerability is scheduled to go public on
Jul 16th 2023
hello, may I know if I will get CVE for this ?
thank you.
I habe already assigned a CVE. Once this report is published you will get it.
to join this conversation