Remote Code Execution in REDAXO CMS

Executive Summary

This vulnerability affects REDAXO, a PHP-based content management system. It allows an authenticated backend user with media upload permission to upload a specially crafted file named shell.php.any.jpg. Web servers with multi-extension PHP handlers may execute this file as PHP code, potentially allowing the attacker to run arbitrary commands on the server.

Useful 0 Not Useful 0

Detection Guidance

Check for uploaded files with double extensions like shell.php.any.jpg in the media pool directory. Review server access logs for suspicious uploads or execution attempts of PHP files disguised as images.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to gain control over the web server, execute malicious code, steal sensitive data, or disrupt services. Systems running REDAXO versions between 5.18.2 and 5.21.0 are at risk. Upgrading to version 5.21.1 or later mitigates this issue.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and security. Organizations may face legal penalties, reputational damage, and loss of trust if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade REDAXO to version 5.21.1 or later immediately. Remove any unauthorized or suspicious files in the media pool directory. Restrict media upload permissions to trusted users only.

Useful 0 Not Useful 0