RiteCMS Remote Code Execution Vulnerability

An authenticated remote code execution vulnerability has been identified in RiteCMS version 3.1.0. The issue arises in the 'parse_special_tags()' function, where crafted content containing specific tags can be processed server-side and executed as code. This vulnerability can be exploited by authenticated users through a cross-site request forgery (CSRF) vulnerability, leading to a chained attack.

Impact

Exploitation of this vulnerability allows for authenticated remote code execution on the server where RiteCMS is hosted.

Reproduction

To reproduce this vulnerability, an authenticated user must upload content that includes a special tag formatted to execute PHP code. The 'parse_special_tags()' function will process this content, and the injected code will be executed on the server. This exploitation can be automated through a CSRF attack, taking advantage of the user's authenticated session.