Badaso CMS file upload vulnerability
The advisory, in context
An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload, enabling an attacker to run arbitrary system commands and achieve full compromise of the underlying host. This has been demonstrated by embedding a backdoor within a PDF and renaming it with a .php extension.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 2.9.11 (inclusive)
No fix recorded for this interval.
124 explicitly affected versions
1.0.0, 1.0.0-alpha.1, 1.0.0-alpha.10, 1.0.0-alpha.11, 1.0.0-alpha.12, 1.0.0-alpha.13, 1.0.0-alpha.14, 1.0.0-alpha.15, 1.0.0-alpha.16, 1.0.0-alpha.17, 1.0.0-alpha.18, 1.0.0-alpha.19, 1.0.0-alpha.2, 1.0.0-alpha.20, 1.0.0-alpha.21, 1.0.0-alpha.22, 1.0.0-alpha.23, 1.0.0-alpha.24, 1.0.0-alpha.25, 1.0.0-alpha.26, 1.0.0-alpha.27, 1.0.0-alpha.28, 1.0.0-alpha.29, 1.0.0-alpha.3, 1.0.0-alpha.30, 1.0.0-alpha.31, 1.0.0-alpha.32, 1.0.0-alpha.33, 1.0.0-alpha.34, 1.0.0-alpha.35, 1.0.0-alpha.36, 1.0.0-alpha.37, 1.0.0-alpha.38, 1.0.0-alpha.39, 1.0.0-alpha.4, 1.0.0-alpha.40, 1.0.0-alpha.5, 1.0.0-alpha.6, 1.0.0-alpha.7, 1.0.0-alpha.8, 1.0.0-alpha.9, 1.0.0-rc, 1.0.0-rc.1, 1.0.0-rc.10, 1.0.0-rc.11, 1.0.0-rc.12, 1.0.0-rc.13, 1.0.0-rc.14, 1.0.0-rc.15, 1.0.0-rc.2, 1.0.0-rc.3, 1.0.0-rc.4, 1.0.0-rc.5, 1.0.0-rc.6, 1.0.0-rc.7, 1.0.0-rc.8, 1.0.0-rc.9, 1.0.1, 1.0.2, 2.0.0, 2.0.0-alpha, 2.0.0-rc, 2.0.0-rc.1, 2.0.0-rc.10, 2.0.0-rc.11, 2.0.0-rc.12, 2.0.0-rc.13, 2.0.0-rc.14, 2.0.0-rc.2, 2.0.0-rc.3, 2.0.0-rc.4, 2.0.0-rc.5, 2.0.0-rc.6, 2.0.0-rc.7, 2.0.0-rc.8, 2.0.0-rc.9, 2.0.1, 2.0.2, 2.1.0, 2.2.0, 2.2.1, 2.2.2, 2.3.0, 2.3.1, 2.4.0, 2.4.1, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.5.0, 2.5.1, 2.5.2, 2.5.3, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.7.0, 2.7.1, 2.8.0, 2.8.1, 2.8.2, 2.9.0, 2.9.1, 2.9.10, 2.9.11, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.9.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"1.0.0",
"1.0.0-alpha.1",
"1.0.0-alpha.10",
"1.0.0-alpha.11",
"1.0.0-alpha.12",
"1.0.0-alpha.13",
"1.0.0-alpha.14",
"1.0.0-alpha.15",
"1.0.0-alpha.16",
"1.0.0-alpha.17",
"1.0.0-alpha.18",
"1.0.0-alpha.19",
"1.0.0-alpha.2",
"1.0.0-alpha.20",
"1.0.0-alpha.21",
"1.0.0-alpha.22",
"1.0.0-alpha.23",
"1.0.0-alpha.24",
"1.0.0-alpha.25",
"1.0.0-alpha.26",
"1.0.0-alpha.27",
"1.0.0-alpha.28",
"1.0.0-alpha.29",
"1.0.0-alpha.3",
"1.0.0-alpha.30",
"1.0.0-alpha.31",
"1.0.0-alpha.32",
"1.0.0-alpha.33",
"1.0.0-alpha.34",
"1.0.0-alpha.35",
"1.0.0-alpha.36",
"1.0.0-alpha.37",
"1.0.0-alpha.38",
"1.0.0-alpha.39",
"1.0.0-alpha.4",
"1.0.0-alpha.40",
"1.0.0-alpha.5",
"1.0.0-alpha.6",
"1.0.0-alpha.7",
"1.0.0-alpha.8",
"1.0.0-alpha.9",
"1.0.0-rc",
"1.0.0-rc.1",
"1.0.0-rc.10",
"1.0.0-rc.11",
"1.0.0-rc.12",
"1.0.0-rc.13",
"1.0.0-rc.14",
"1.0.0-rc.15",
"1.0.0-rc.2",
"1.0.0-rc.3",
"1.0.0-rc.4",
"1.0.0-rc.5",
"1.0.0-rc.6",
"1.0.0-rc.7",
"1.0.0-rc.8",
"1.0.0-rc.9",
"1.0.1",
"1.0.2",
"2.0.0",
"2.0.0-alpha",
"2.0.0-rc",
"2.0.0-rc.1",
"2.0.0-rc.10",
"2.0.0-rc.11",
"2.0.0-rc.12",
"2.0.0-rc.13",
"2.0.0-rc.14",
"2.0.0-rc.2",
"2.0.0-rc.3",
"2.0.0-rc.4",
"2.0.0-rc.5",
"2.0.0-rc.6",
"2.0.0-rc.7",
"2.0.0-rc.8",
"2.0.0-rc.9",
"2.0.1",
"2.0.2",
"2.1.0",
"2.2.0",
"2.2.1",
"2.2.2",
"2.3.0",
"2.3.1",
"2.4.0",
"2.4.1",
"2.4.10",
"2.4.11",
"2.4.12",
"2.4.13",
"2.4.14",
"2.4.2",
"2.4.3",
"2.4.4",
"2.4.5",
"2.4.6",
"2.4.7",
"2.4.8",
"2.4.9",
"2.5.0",
"2.5.1",
"2.5.2",
"2.5.3",
"2.6.0",
"2.6.1",
"2.6.2",
"2.6.3",
"2.7.0",
"2.7.1",
"2.8.0",
"2.8.1",
"2.8.2",
"2.9.0",
"2.9.1",
"2.9.10",
"2.9.11",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9"
]
}