UnoPim vulnerable to remote code execution through Arbitrary File upload

Vulnerability

Overview CVE-2025-55743 is an arbitrary file upload vulnerability in UnoPim, an open-source PIM system built on Laravel. The user creation feature's image upload only performs client-side file type validation, allowing an attacker to intercept the upload request (e.g., via a proxy like Burp Suite) and modify both the file extension and content to a malicious PHP script [1][3].

Exploitation

An attacker can upload a PHP webshell by changing the multipart form data: the filename to poc.php and the content to PHP code (e.g., <?php system($_GET['cmd']); ?>). The uploaded file is stored on the server and accessible via a URL like /storage/admins/{id}/poc.php. By accessing that URL with a command parameter, the attacker achieves remote code execution [3].

Impact

Successful exploitation allows any authenticated user (who can change their profile picture) to execute arbitrary system commands. This can lead to full server compromise, data theft, or lateral movement within the network. The vulnerability is rated high severity due to the potential for complete system takeover [3].

Mitigation

The issue is fixed in UnoPim version 0.2.1. Users should upgrade immediately. No workarounds are available [1][3].