PPress Server-Side Template Injection Vulnerability Allowing Arbitrary Code Execution

A server-side template injection vulnerability has been identified in PPress CMS version 0.0.9-beta. This vulnerability allows attackers to execute arbitrary code by uploading crafted themes through the admin interface. The issue arises from the application's use of the Jinja2 template engine, which can be exploited by injecting malicious code into customizable template files.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the server.

Reproduction

To reproduce this vulnerability, an administrator must upload a modified theme that includes injected code. After exporting the default template, the 'profile.html' file can be edited to include malicious code, such as a payload that executes a command on the server. This modified file should then be packaged into a zip file and uploaded as a new theme. Once the theme is activated, the injected code will be executed on the server.