CVE-2020-10386

Vulnerability

The vulnerability resides in admin/imagepaster/image-upload.php in Chadha PHPKB Standard Multi-Language version 9. The script does not validate the file extension or content type, allowing an authenticated attacker to upload a file containing PHP code to the admin/js/ directory. The upload is performed via a POST request with parameters action=imageinsert_upload, imgMime=image/php, and imgName set to a path like ../js/index.png or ../js/shell.php. The file is saved with the given name, and the server executes it as PHP due to misconfiguration or lack of extension filtering [1][2].

Exploitation

An attacker must have valid credentials with at least Writer or Editor role (Superuser, Writer, Translator, or Editor). After logging in, the attacker sends a crafted POST request to admin/imagepaster/image-upload.php with a file containing PHP code (e.g., <?php system($_GET['cmd']); ?>). The imgName parameter can be set to ../js/shell.php to upload a .php file, or to ../js/index.png if the server executes .png files as PHP. The response returns the URL of the uploaded file, which can then be accessed with a command parameter to execute arbitrary system commands [1][2].

Impact

Successful exploitation results in remote code execution as the web server user. An attacker can execute arbitrary commands, read sensitive files, modify data, or pivot to other systems. This leads to full compromise of the PHPKB application and potentially the underlying server [1][2].

Mitigation

No official patch has been released by the vendor as of the publication date (2020-03-12). As a workaround, restrict access to the admin panel to trusted users only, implement strict file upload validation (e.g., whitelist allowed extensions and MIME types), and disable PHP execution in the admin/js/ directory via server configuration (e.g., .htaccess with php_flag engine off). Users should monitor for updates from the vendor [1][2].