appRain CMF Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in appRain CMF version 4.0.5. This vulnerability allows authenticated administrative users to upload malicious PHP files through the file manager upload endpoint. Once uploaded, these files can be executed as web shells, providing command execution capabilities on the server.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where appRain CMF 4.0.5 is installed.

Reproduction

To reproduce this vulnerability, an authenticated administrative user must upload a crafted PHP file through the file manager upload endpoint. The uploaded file should be designed to execute commands on the server, such as a web shell. Once the file is uploaded, it can be accessed via the uploads directory, where the web shell can be executed.