Soosyze File Upload Vulnerability Allowing Arbitrary PHP Code Execution

A file upload vulnerability has been identified in Soosyze version 2.0.0. This issue allows attackers to upload arbitrary HTML files containing embedded PHP code. Exploitation of this vulnerability could lead to the execution of malicious PHP scripts on the server. The flawed file upload mechanism also has the potential to expose sensitive file paths.

Impact

Exploitation of this vulnerability could result in unauthorized execution of PHP scripts on the server, potentially leading to a full compromise of the web application or server.

Reproduction

To reproduce this vulnerability, upload a file with an .html extension that contains PHP code, such as a phpinfo() script. Once the file is uploaded, access it through the web server. The PHP code will be executed, and the output will include sensitive information such as file paths, which could be exploited further.