Invoice Ninja File Upload Vulnerability in Admin Restore Function Allowing Arbitrary Code Execution

A vulnerability exists in Invoice Ninja versions through 5.11.72, related to improper handling of uploaded files in the admin 'Restore' function. This issue enables attackers with admin credentials to execute arbitrary code on the server by uploading malicious .php files.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of code on the server, potentially allowing an attacker to take control of the server or disrupt its operations.

Reproduction

To reproduce this vulnerability, an admin user can upload a .php file through the 'Restore' function. The application does not properly validate or restrict file uploads, allowing the execution of the uploaded PHP code on the server.

Remediation

Users can update to Invoice Ninja version 5.12.27 or later, where this vulnerability has been addressed.