CVE-2022-24553

Vulnerability

Zfaka versions up to and including 1.4.5 contain a remote code execution vulnerability in the background file upload functionality. The only file extension check is performed client-side in JavaScript (/public/res/layui/lay/modules/upload.js); no server-side validation exists in the upload controller (/application/modules/Admin/controllers/Products.php). The upload path is predictable (/public/res/upload/ followed by the current date in Y-m-d format) and the filename is generated using the current time (His format), making the full URL of an uploaded file easily guessable [1].

Exploitation

An attacker with administrative access to the Zfaka backend can upload a malicious PHP file by sending a POST request to /Admin/products/imgurlajax with a valid product ID (pid parameter) and a Referer header pointing to the admin product edit page. The request must include the file in a multipart form. Because no server-side extension filtering is applied, a .php file is accepted and stored in the predictable upload directory. The attacker can then access the uploaded file directly via its URL to execute arbitrary PHP code [1].

Impact

Successful exploitation allows an authenticated attacker to execute arbitrary PHP commands on the web server, leading to full compromise of the application and potentially the underlying system. This includes data exfiltration, modification, or deletion, and further lateral movement within the network [1].

Mitigation

As of the publication date of the reference (February 2022), no official patch has been released for Zfaka. The vendor has not addressed the issue in any subsequent version. Until a fix is available, administrators should implement server-side file extension validation and restrict upload functionality to trusted users only. Consider disabling the upload feature if not required [1].