299Ko CMS Unrestricted File Upload Vulnerability in File Management Component

A critical vulnerability allowing unrestricted file uploads has been identified in 299Ko CMS version 2.0.0. This issue resides in the file management component, specifically within the file '/admin/filemanager/view'. The vulnerability can be exploited remotely, and has been publicly disclosed along with a proof-of-concept exploit.

Impact

Exploitation of this vulnerability allows for unrestricted file uploads, which could lead to the upload of malicious files that are executed on the server, causing remote code execution.

Reproduction

The vulnerability can be reproduced by accessing the file management section in the admin panel. Once there, upload a file through the file manager that is typically restricted, such as a PHP file. The uploaded file can then be executed, leading to remote code execution.