CVE-2020-10389

Vulnerability

CVE-2020-10389 affects Chadha PHPKB Standard Multi-Language 9. The vulnerability exists in admin/save-settings.php, where the application improperly handles user-supplied POST parameters when saving global settings. An authenticated attacker can inject arbitrary PHP code into any POST parameter, which is then stored and executed on the server. This affects version Multi-Language 9 as disclosed in the exploit references [1][2].

Exploitation

Exploitation requires an attacker to have valid administrative credentials to access the admin panel. The attacker sends a crafted POST request to admin/save-settings.php with PHP code embedded in one or more parameters (e.g., within <?php ?> tags). The application writes this input into a configuration file that is later included in PHP execution, causing the injected code to be evaluated server-side [1][2]. No additional user interaction is required beyond the initial auth.

Impact

Successful exploitation yields arbitrary code execution on the web server with the privileges of the web application user. The attacker can execute system commands, read/write files, or further compromise the host environment. This results in a complete loss of confidentiality, integrity, and availability of the affected PHPKB instance and potentially the underlying server [1][2].

Mitigation

As of the available references, no official patch or fixed version has been announced by Chadha PHPKB for CVE-2020-10389. The vendor has not released a security update addressing this issue. Users are advised to restrict access to the admin panel, apply strong authentication, and monitor for suspicious POST requests to admin/save-settings.php. Until a patch is provided, the only reliable mitigation is to ensure the application is not exposed to untrusted networks or to disable the vulnerable functionality if possible [1][2].