Listen to this Post
How the CVE Works
The vulnerability in Erupt v1.12.19 stems from insufficient validation in the `/upload/GoodsCategory/image` endpoint, allowing attackers to upload malicious files (e.g., .php, .jsp) instead of legitimate images. Due to improper file type checks, an attacker can upload a crafted file (e.g., a webshell) and execute arbitrary code on the server. This occurs because the application fails to verify file extensions, MIME types, or sanitize uploaded content. Once uploaded, the malicious file can be accessed via the web directory, leading to remote code execution (RCE) under the server’s permissions.
DailyCVE Form:
Platform: Erupt
Version: 1.12.19
Vulnerability: Unrestricted File Upload
Severity: Moderate
Date: Jun 5, 2025
Prediction: Patch by Jul 1, 2025
What Undercode Say:
Exploitation:
- Craft a malicious file (e.g., `shell.php` with RCE payload).
2. Upload via `/upload/GoodsCategory/image` bypassing client-side checks.
- Access the file at `/uploads/shell.php` to trigger execution.
Protection:
1. Validate file extensions server-side:
$allowed = ['jpg', 'png'];
if (!in_array(pathinfo($file['name'], PATHINFO_EXTENSION), $allowed)) {
die("Invalid file type.");
}
2. Verify MIME types:
$finfo = new finfo(FILEINFO_MIME_TYPE);
if (false === $ext = array_search($finfo->file($tmp_name), ['jpg' => 'image/jpeg'], true)) {
die("Invalid MIME.");
}
3. Disable execution in upload directories via `.htaccess`:
RemoveHandler .php .phtml .phar
4. Use random filenames to prevent direct access:
$new_name = bin2hex(random_bytes(16)) . '.' . $ext;
Detection Commands:
- Check upload directory for suspicious files:
find /var/www/uploads -name ".php"
- Audit web logs for upload attempts:
grep "POST /upload/GoodsCategory/image" /var/log/nginx/access.log
Mitigation Patch (Example):
// Erupt patch: Add strict file validation
if (!file.getContentType().startsWith("image/")) {
throw new SecurityException("Invalid file type.");
}
Analytics:
- Attack Vector: Network-based (HTTP)
- CVSS Score: 6.5 (Medium)
- Exploitability: Low (requires auth)
- Affected Systems: Erupt <=1.12.19
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
