FileThingie Arbitrary File Upload Vulnerability Allowing Remote Code Execution

An arbitrary file upload vulnerability has been identified in FileThingie version 2.5.7. This vulnerability allows attackers to upload malicious ZIP files containing PHP shells through the ft2.php endpoint. Once uploaded, the ZIP files can be extracted using the application's unzip functionality, placing the PHP shells in accessible directories where they can be executed, allowing for arbitrary command execution on the server.

Impact

Exploitation of this vulnerability allows for arbitrary file upload, with the potential for uploaded files to be executed as PHP scripts, leading to arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, upload a ZIP file containing a PHP shell through the ft2.php endpoint. After the file is uploaded, use the application's unzip feature to extract the ZIP file. The extracted PHP shell can then be accessed via the web server, allowing for command execution on the server.