Chevereto Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Chevereto version 3.13.4 Core. This issue allows attackers to inject malicious code during the database configuration installation process. By manipulating the database table prefix parameter, attackers can write a PHP shell file and execute arbitrary system commands through a crafted POST request.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Chevereto is installed.

Reproduction

To reproduce this vulnerability, send a POST request to the Chevereto installation endpoint with a crafted database table prefix parameter that includes injected PHP code. The injected code should be designed to write a PHP file containing a payload that, when executed, runs arbitrary system commands. After the injection, the injected code can be executed by accessing the PHP file through the web server.