PAD CMS Unrestricted File Upload Vulnerability Leading to Remote Code Execution

A vulnerability in PAD CMS's photo upload feature allows unauthenticated remote attackers to upload files of any type and extension without restriction. This flaw arises from a client-controlled permission check parameter and can be exploited to execute uploaded files, leading to remote code execution. The issue affects all three templates: www, bip, and ww+bip.

Impact

Exploitation of this vulnerability allows for remote code execution on the server where PAD CMS is hosted.