SueamCMS File Upload Vulnerability Allowing Arbitrary Code Execution

A file upload vulnerability has been identified in SueamCMS version 0.1.2, which allows remote attackers to execute arbitrary code. This issue arises from a lack of proper input filtering, enabling unauthorized file uploads, including those containing malicious code.

Impact

Exploitation of this vulnerability could lead to arbitrary code execution on the server where SueamCMS is hosted.

Reproduction

To reproduce this vulnerability, send a POST request to 'mgt_file.php' with the 'upfiles' parameter containing a file named 'test2.php'. This file should include a PHP payload, such as a script that executes 'phpinfo()'. The request must also include a valid session cookie.