FeehiCMS Has a Remote Code Execution via Unrestricted File Upload in Ad Management
The advisory, in context
FeehiCMS version 2.1.1 has a Remote Code Execution via Unrestricted File Upload in Ad Management. FeehiCMS version 2.1.1 allows authenticated remote attackers to upload files that the server later executes (or stores in an executable location) without sufficient validation, sanitization, or execution restrictions. An authenticated remote attacker can upload a crafted PHP file and cause the application or web server to execute it, resulting in remote code execution (RCE).
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases through 2.1.1 (inclusive)
No fix recorded for this interval.
40 explicitly affected versions
0.0.1, 0.0.2, 0.0.3, 0.0.4, 0.0.5, 0.0.6, 0.0.7, 0.0.8, 0.0.9, 0.1.0, 0.1.1, 0.1.2, 0.1.3, 1.0.0-alpha3, 1.0.0alpha1, 1.0.0alpha2, 1.0.0beta1, 1.0.0beta2, 1.0.0beta3, 1.0.0rc1, 1.0.0rc2, 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.4.1, 2.0.5, 2.0.5.1, 2.0.6, 2.0.7, 2.0.7.1, 2.0.8, 2.0.8.1, 2.1.0, 2.1.0-beta, 2.1.0-beta2, 2.1.0.1, 2.1.0.2, 2.1.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "2.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"0.0.1",
"0.0.2",
"0.0.3",
"0.0.4",
"0.0.5",
"0.0.6",
"0.0.7",
"0.0.8",
"0.0.9",
"0.1.0",
"0.1.1",
"0.1.2",
"0.1.3",
"1.0.0-alpha3",
"1.0.0alpha1",
"1.0.0alpha2",
"1.0.0beta1",
"1.0.0beta2",
"1.0.0beta3",
"1.0.0rc1",
"1.0.0rc2",
"2.0.0",
"2.0.1",
"2.0.2",
"2.0.3",
"2.0.4",
"2.0.4.1",
"2.0.5",
"2.0.5.1",
"2.0.6",
"2.0.7",
"2.0.7.1",
"2.0.8",
"2.0.8.1",
"2.1.0",
"2.1.0-beta",
"2.1.0-beta2",
"2.1.0.1",
"2.1.0.2",
"2.1.1"
]
}