DolphinPHP Incomplete Fix CVE-2021-46097 common.php os command injection

Vulnerability

DolphinPHP versions up to 1.5.1 (inclusive) contain an OS command injection vulnerability in the file /application/common.php. This is an incomplete fix of CVE-2021-46097. The issue lies in the _user_func method, where a user-controlled parameter (ids or param[1]) is passed to shell_exec() after a flawed attempt to filter dangerous functions via is_disable_func(). The attacker can influence the function name through a log rule setting in the database. The param value is derived from a |-separated string that matches against the action_info['log'] rule stored in the database [1].

Exploitation

An attacker with administrative access to the DolphinPHP backend can navigate to Behavior Management and edit the log rule for the "Delete Attachment" action. The rule must be set to [details|shell_exec] test ([details]) and the module set to "System" (not "User"). When a subsequent request is made to delete an attachment, the attacker can send crafted POST parameters like ids[]=calc%26&ids[]=X (where X is a valid attachment ID). The %26 decodes to &, and the param[1] value becomes shell_exec, which bypasses the disabled function list and executes the command via shell_exec() [1].

Impact

Successful exploitation allows an authenticated administrator to execute arbitrary operating system commands on the server. This can lead to full system compromise, data theft, malware deployment, or lateral movement within the network. The remote execution vector increases the severity, as the attacker needs only a valid session with admin privileges [1].

Mitigation

As of the publication date (2023-02-21), no official patch has been released for DolphinPHP 1.5.1. The vendor recommendation is to upgrade to a version beyond 1.5.1 once available. No workaround has been documented. Organizations using DolphinPHP should restrict administrative access to trusted users and monitor log settings for unauthorized changes. There is no indication of inclusion in CISA KEV [1].