Directory Traversal in ApiAdmin Leading to Remote Code Execution

Executive Summary

This is an Arbitrary File Upload Remote Code Execution (RCE) flaw in ApiAdmin version 5.0 and earlier. The vulnerability exists in the admin file-upload endpoint POST /admin/Index/upload. Any logged-in admin user can upload a PHP file without validation for extension, content, or path. The file is saved directly into a web-accessible directory with its original extension, allowing attackers to execute arbitrary PHP code by accessing the file via HTTP.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized PHP files in the public/upload/Ymd/ directory. Use commands like 'find /var/www/public/upload/ -name "*.php"' to locate suspicious files. Monitor HTTP POST requests to /admin/Index/upload with PHP file extensions.

Useful 0 Not Useful 0

Impact Analysis

An attacker with admin access can upload a malicious PHP file, such as a webshell, to the server. This allows them to execute arbitrary commands on the server, potentially leading to full system compromise, data theft, or further network infiltration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access control. Organizations using affected ApiAdmin versions may face compliance violations, legal penalties, and reputational damage.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ApiAdmin to a patched version if available. Implement strict file upload validation to block PHP files. Restrict write permissions to the public/upload/ directory. Review logs for unauthorized uploads and remove any suspicious files.

Useful 0 Not Useful 0