Listen to this Post
The vulnerability CVE-2025-11136 exists in the `webUploader` function within the file `/app/app/controller/File.php` of the YiFang CMS backend component. This function is responsible for handling file uploads but improperly validates user-controlled input. Specifically, the `uploadpath` argument can be manipulated by an attacker. The code lacks sufficient sanitization or access control checks for this parameter, allowing the upload directory to be arbitrarily defined.
By crafting a malicious HTTP request, an attacker can control the `uploadpath` to point to a writable directory within the web server’s root, such as one accessible via the web. This flaw, classified as an Unrestricted Upload of File with Dangerous Type (CWE-434), enables the remote upload of arbitrary files. An attacker with high-privilege backend access can exploit this to upload a malicious script, like a web shell, to the server. Once uploaded, the script can be executed remotely by accessing its URL, leading to a full compromise of the CMS and potential remote code execution on the underlying host. The attack is network-based, requires low complexity, and no user interaction, though high authentication privileges are needed. A public proof-of-concept exploit is available, increasing the risk of active attacks.
Platform: YiFang CMS
Version: Up to 2.0.2
Vulnerability : Unrestricted File Upload
Severity: High
date: 2025-09-28
Prediction: 2025-02-15
What Undercode Say:
curl -X POST -F "[email protected]" -F "uploadpath=./public/" http://target/cms/admin/file/webUploader
// Example of malicious parameter manipulation $_POST['uploadpath'] = '../../public/'; // Exploits lack of path traversal filtering
How Exploit:
1. Attacker gains authenticated admin access.
2. Crafts POST request to vulnerable `/webUploader` endpoint.
3. Sets `uploadpath` to a web-accessible directory.
- Uploads a file with executable extension (e.g.,
.php). - Accesses the uploaded file via HTTP to trigger code execution.
Protection from this CVE
1. Upgrade YiFang CMS.
2. Implement strict input validation.
3. Restrict upload file permissions.
4. Use Web Application Firewall.
5. Apply principle of least privilege.
Impact:
Unauthorized file upload, Remote code execution, System integrity compromise, Potential data breach.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
