Unrestricted File Upload in phpwcms

Executive Summary

This is an unrestricted file upload vulnerability in phpwcms versions up to 1.9.49/1.12.3. It allows attackers to upload malicious files with dangerous extensions like .phtml to the web-accessible content/form/ directory. When .phtml is mapped to PHP execution on the server, these files can be executed remotely without authentication, leading to arbitrary code execution and potential full system compromise.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the content/form/ directory of your phpwcms installation. Look for files with extensions like .phtml, .php, or other executable types. Use commands like 'find /path/to/phpwcms/content/form/ -type f -name "*.phtml"' to search for suspicious files.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to execute arbitrary PHP code with the privileges of the web server account. This may allow reading sensitive data like database credentials, modifying CMS content, creating admin accounts, or accessing other secrets. The attack is remote and requires no authentication.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in data breaches, unauthorized modifications, or loss of data integrity, all of which are compliance violations.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade phpwcms to version 1.9.50 or 1.12.4 or later immediately to address the vulnerability.
• Review and update the .htaccess file in the content/form/ directory to block access to executable files and disable PHP execution.
• Scan uploaded files for PHP tags or MIME type mismatches using tools like 'file' or 'exiftool' to detect malicious uploads.
• Temporarily disable public upload forms until the upgrade is completed to prevent exploitation.

Useful 0 Not Useful 0