Listen to this Post
The vulnerability in Pagekit CMS v1.0.18 involves an authenticated arbitrary file upload in the /storage/poc.php component. Attackers with valid user credentials can upload malicious PHP files to the server. This is possible due to insufficient validation of file types and paths in the storage functionality. The upload mechanism does not properly restrict dangerous file extensions, allowing .php files to be placed in web-accessible directories. Once uploaded, the crafted PHP file can be directly accessed via HTTP requests. This leads to remote code execution as the server interprets the PHP code. The vulnerability stems from lack of input sanitization and weak access controls. The storage component fails to verify user permissions adequately for file operations. Attackers exploit this by sending multipart/form-data requests with malicious content. The server saves the file without proper checks, enabling command injection through web shell execution. The project is archived, so no security updates are provided, increasing the risk. This flaw allows attackers to execute operating system commands on the host server. It compromises the entire CMS and underlying system integrity. The vulnerability is critical due to the ease of exploitation and high impact. It requires authentication, but default or weak credentials amplify the threat. The code injection occurs via uploaded scripts that trigger system calls. This effectively bypasses security mechanisms intended to isolate user inputs. The storage API endpoint is vulnerable to manipulation of file metadata. Overall, it’s a severe issue leading to full server takeover if exploited.
Platform: Pagekit CMS
Version: v1.0.18
Vulnerability: Authenticated file upload
Severity: Critical
Date: Dec 17, 2025
Prediction: No patch expected
What Undercode Say: Analytics
Showing bash commands and codes related to the blog
curl -X POST -F “[email protected]” http://target/pagekit/storage/poc.php
find /var/www/pagekit -name “.php” -type f
grep -r “storage” /var/www/pagekit/components/
echo “” > shell.php
chmod 755 shell.php
How Exploit: Upload malicious PHP file via authenticated request to /storage/poc.php endpoint, then access the file to execute commands.
Protection from this CVE: Disable file uploads, restrict access to storage component, implement input validation, use web application firewall.
Impact: Remote code execution, server compromise, data breach, system takeover.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
