Listen to this Post
The vulnerability exists within the `mergeMultipartUpload` function of the `/app/utils/base/plugin/P_file.php` file in YiFang CMS versions up to and including 2.0.5. This function is responsible for handling file uploads but implements improper access controls and insufficient validation. Specifically, the flaw allows for the manipulation of the `File` argument. Attackers can exploit this by sending crafted HTTP requests containing malicious file payloads. The system fails to properly validate the file type, extension, or content, leading to unrestricted upload. Once a dangerous file, such as a web shell with a `.php` extension, is uploaded, it is stored on the server within the web-accessible directory. Remote attackers can then execute arbitrary code by directly accessing the uploaded file via a web browser. The attack requires low complexity and can be performed remotely by an authenticated user with low privileges, leading to a complete compromise of confidentiality, integrity, and system availability.
dailycve form:
Platform: YiFang CMS
Version: Up to 2.0.5
Vulnerability: Unrestricted File Upload
Severity: High
date: 2025-08-24
Prediction: No patch expected
What Undercode Say:
Analytics
grep -r "mergeMultipartUpload" /path/to/cms/ find /var/www/html -name "P_file.php" -type f curl -X POST -F "[email protected]" http://target/upload_endpoint
How Exploit:
1. Attacker authenticates with low-privilege account.
2. Crafts POST request to vulnerable `mergeMultipartUpload` endpoint.
3. Uploads a malicious file (e.g., web shell).
- Accesses the uploaded file to execute arbitrary system commands.
Protection from this CVE:
Update CMS beyond v2.0.5.
Restrict access to `P_file.php`.
Implement strict file-type whitelisting.
Store uploaded files outside web root.
Impact:
Remote Code Execution (RCE).
Complete system compromise.
High severity CVSS 8.8.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
