FeehiCMS index.php insert unrestricted upload

A critical unrestricted file upload vulnerability exists in FeehiCMS versions up to 2.1.1. The flaw resides in the insert function of the user creation endpoint /admin/index.php?r=user%2Fcreate, where the User[avatar] parameter is not properly validated. This allows an attacker to upload arbitrary files without restriction [1].

Exploitation of this vulnerability can be performed remotely, as stated in the advisory. No authentication is explicitly mentioned, though the endpoint is part of the admin panel, which may require prior access. The lack of server-side validation on the file type leads to a direct file upload bypass [1].

Successful exploitation could allow an attacker to upload a malicious script (e.g., PHP web shell) that can be executed on the server, leading to remote code execution, data compromise, and full server takeover. Given that the exploit has been publicly disclosed, the risk is elevated [1].

The vendor was contacted but did not respond, meaning no official patch or workaround has been released. Users are advised to apply strict file upload restrictions (e.g., allow only image types, restrict execution permissions) or consider migrating to alternative solutions. The public availability of exploit details increases the urgency for remediation [1].