ImpressCMS Unrestricted File Upload Vulnerability in Version 1.4.4

A file upload vulnerability has been identified in ImpressCMS version 1.4.4, stemming from inadequate extension sanitization. This flaw allows attackers to upload potentially malicious files by exploiting weak upload restrictions. The vulnerability arises from a blacklist method that fails to effectively filter harmful file types, enabling the execution of arbitrary PHP code on the server.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, with the potential to execute uploaded PHP files on the server, leading to arbitrary code execution.

Reproduction

The vulnerability can be reproduced by uploading a file with a sanitized extension such as .php2, .php6, .php7, .phps, .pht, .pgif, .shtml, .htaccess, .phar, or .inc. The uploaded file can then be accessed through the web server, where any PHP code included in the file will be executed.