Vvveb CMS Remote Code Execution Vulnerability via Unrestricted .phtml File Upload

A remote code execution vulnerability has been identified in Vvveb CMS version 1.0.8. This issue arises in the media upload handler, where authenticated attackers can upload PHP web shells with a .phtml extension, bypassing the extension deny-list. The uploaded files are placed in a publicly accessible media directory. Once the malicious file is uploaded, it can be accessed over HTTP, allowing the attacker to execute arbitrary operating system commands and potentially compromise the entire server.

Impact

Exploitation of this vulnerability leads to full server compromise, allowing attackers to execute arbitrary operating system commands with the same privileges as the web server user.

Remediation

Users can update to Vvveb CMS version 1.0.8.1, which addresses this vulnerability by adding .phtml to the extension deny-list for media uploads.