ProjectSend Remote Code Execution Vulnerability via File Extension Manipulation

A remote code execution vulnerability has been identified in ProjectSend version r1605. This issue allows attackers to upload malicious files by manipulating file extensions. The vulnerability is present in the upload.process.php endpoint, where attackers can disguise shell scripts with misleading extensions to execute arbitrary commands on the server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where ProjectSend is installed.

Reproduction

To reproduce this vulnerability, upload a file through the upload.process.php endpoint. Rename the file to include a shell script payload, such as a reverse shell command, and disguise the extension as a JPEG file. Once the file is uploaded, the server will execute the embedded command, resulting in remote code execution.