FeehiCMS index.php update unrestricted upload

Vulnerability

Overview

CVE-2024-8294 is a critical unrestricted file upload vulnerability affecting FeehiCMS versions up to 2.1.1. The flaw resides in the update function of the file /admin/index.php?r=friendly-link%2Fupdate. By manipulating the FriendlyLink[image] argument, an attacker can upload arbitrary files without proper validation, leading to a complete compromise of the server [1].

Exploitation

The attack is performed remotely over HTTP. Although the vulnerable endpoint is located in the admin panel, the description does not specify authentication requirements; however, typical admin functions require prior authentication. An attacker with valid admin credentials (or who has obtained a session through other means) can send a crafted request to the update endpoint with a malicious file in the FriendlyLink[image] parameter. The lack of file type or content filtering allows the upload of executable scripts (e.g., PHP shells) [1].

Impact

Successful exploitation grants the attacker the ability to execute arbitrary code on the web server with the privileges of the web application. This can lead to full site takeover, data theft, defacement, or use of the server for further attacks. The vulnerability is classified as critical due to the high potential for complete compromise [1].

Mitigation

As of the publication date, the vendor has not responded to disclosure and no patch is available. Users of FeehiCMS should consider restricting access to the admin panel (e.g., via IP whitelisting or VPN) and monitoring for suspicious file uploads. Migrating to an alternative CMS or applying custom input validation on the FriendlyLink[image] parameter may also reduce risk [1][2].