ClassCMS Code Execution Vulnerability in Model Management Feature

A code execution vulnerability exists in ClassCMS version 4.8. This issue allows attackers to execute arbitrary code by crafting a payload in the classview parameter within the model management feature of the administrator backend. Exploitation of this vulnerability could lead to unauthorized control over the server.

Impact

Successful exploitation allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, log into the ClassCMS admin backend and navigate to the Model Management section. Select any model and click to add a page. In the 'classview' parameter, upload a file that can be executed, such as a PHP file. Once the file is uploaded, access it through the 'phpinfo' command to verify execution. This can be done by visiting the uploaded file's URL, which will display the PHP information page, indicating that the code execution was successful.