FoxCMS Arbitrary File Upload Vulnerability in LocalTemplate.php Allowing Remote Code Execution
Vulnerability
A vulnerability allowing arbitrary file upload has been identified in FoxCMS version 1.2.5. This issue resides in the LocalTemplate.php component, where attackers can upload a specially crafted Zip file that leads to the execution of arbitrary code.
Impact
Exploitation of this vulnerability allows for remote code execution on the server where FoxCMS is installed.
Reproduction
To reproduce this vulnerability, upload a crafted Zip file through the application's file upload feature. The file should be designed to exploit the arbitrary file upload vulnerability by including malicious code that can be executed on the server.
Remediation
Users are advised to update to FoxCMS version 1.2.6, which includes security enhancements to address this vulnerability.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.