CVE-2020-35734

Vulnerability

Batflat CMS version 1.3.6 contains a code injection vulnerability in the sruu.pl component, specifically in the Users tab of the administration panel. Input fields such as the "Displayed name" are not sanitized, allowing an authenticated user with access to the Users tab to inject arbitrary PHP code. This is confirmed in the official issue tracker [1].

Exploitation

An attacker must first authenticate to the Batflat administration panel. Once logged in, they navigate to the Users tab and edit an existing user (or create a new one). By entering PHP code into fields like "Displayed name", the code is saved and subsequently executed on the server. No additional privileges beyond standard admin access are required. The injected code runs with the web server's privileges.

Impact

Successful exploitation results in arbitrary PHP code execution on the web server, leading to full remote code execution (RCE). The attacker can then compromise the entire CMS installation, access or modify sensitive data, and potentially pivot to other systems.

Mitigation

The maintainer has marked Batflat as unsupported (end-of-life). No official patch has been released for version 1.3.6. As of the publication date (2021-02-15), users should upgrade to a maintained fork or migrate away from the software entirely. This vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog. Workarounds include restricting access to the admin panel to trusted users only.