Executive Summary

This vulnerability exists because the PAD CMS file upload functionality uses a client-controlled permission check parameter, allowing an unauthenticated remote attacker to upload files of any type and extension without restriction. These uploaded files can then be executed, leading to Remote Code Execution. It affects all three templates: www, bip, and ww+bip.

Useful 0 Not Useful 0

Impact Analysis

An attacker can exploit this vulnerability to upload and execute arbitrary files on the server without authentication, resulting in Remote Code Execution. This can lead to full compromise of the affected system, unauthorized access, data theft, or disruption of services.

Useful 0 Not Useful 0

Mitigation Strategies

Since the product is End-Of-Life and no patches will be published, immediate mitigation steps include disabling or restricting the file upload functionality in PAD CMS, implementing network-level controls such as blocking access to the vulnerable endpoints, and monitoring for any suspicious file uploads or executions. Consider isolating the affected system from critical networks to reduce risk.

Useful 0 Not Useful 0