Executive Summary

This vulnerability exists because the PAD CMS upload photo functionality uses a client-controlled permission check parameter, allowing an unauthenticated remote attacker to upload files of any type and extension without restriction. These uploaded files can then be executed, leading to Remote Code Execution. It affects all three templates: www, bip, and ww+bip.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to Remote Code Execution by an unauthenticated attacker, which means an attacker can run arbitrary code on the affected system. This can result in full system compromise, data theft, service disruption, or further attacks within the network.

Useful 0 Not Useful 0

Mitigation Strategies

Since the product is End-Of-Life and no patches will be published, immediate mitigation steps include disabling or restricting the upload photo functionality to prevent unauthenticated file uploads, implementing network-level controls such as blocking access to the upload endpoint, and monitoring for any suspicious file uploads or executions. Consider migrating to a supported product version or alternative CMS to avoid exposure.

Useful 0 Not Useful 0