Pagekit CMS Arbitrary File Upload Vulnerability Leading to Remote Code Execution

A vulnerability allowing authenticated users to upload arbitrary files has been identified in Pagekit CMS version 1.0.18. This issue resides in the /storage/poc.php component and allows attackers to execute arbitrary code by uploading a specially crafted PHP file.

Impact

Exploitation of this vulnerability allows for the installation of a persistent web shell, enabling remote code execution on the server.

Reproduction

To reproduce this vulnerability, authenticate as a user with permission to upload files. Navigate to the /storage/ directory and upload a PHP file containing malicious code. Once the file is uploaded, execute it to achieve remote code execution on the server.