Executive Summary

This vulnerability exists in PAD CMS's photo upload functionality, where a client-controlled permission check parameter allows an unauthenticated remote attacker to upload files of any type and extension without restriction. These uploaded files can then be executed, leading to Remote Code Execution on the affected system. The issue affects all three templates: www, bip, and ww+bip.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to Remote Code Execution by an unauthenticated attacker, which means an attacker can run arbitrary code on the affected system. This can result in full system compromise, data theft, service disruption, or further attacks within the network.

Useful 0 Not Useful 0

Mitigation Strategies

Since the product is End-Of-Life and no patches will be published, immediate mitigation steps include disabling or restricting access to the photo upload functionality to prevent unauthenticated file uploads, implementing network-level controls such as firewalls or web application firewalls (WAF) to block malicious requests, and considering removing or replacing the vulnerable PAD CMS installation with a supported alternative.

Useful 0 Not Useful 0