Perch CMS Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Perch CMS version 3.2, allowing authenticated administrators to upload arbitrary PHP files via the assets management interface. Exploitation involves uploading a malicious .phar file that can execute system commands, thereby allowing arbitrary command execution on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Perch CMS is installed.

Reproduction

To reproduce this vulnerability, log into an admin account and navigate to the assets management interface. Upload a .phar file containing a PHP payload that includes system command execution capabilities. After uploading, the file can be accessed through the admin resources, allowing the execution of commands on the server.