Serendipity Remote Code Execution Vulnerability

A remote code execution vulnerability exists in Serendipity version 2.5.0, allowing authenticated administrators to upload malicious PHP files via the media upload feature. Exploitation involves creating a PHP shell that can execute arbitrary system commands on the web server.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where Serendipity is hosted.

Reproduction

To reproduce this vulnerability, an authenticated administrator must upload a PHP file through the media upload feature. The uploaded file can be a PHP shell that includes a form for executing system commands. Once the file is uploaded, the shell can be accessed and used to execute commands on the server.