CVE-2024-8294: FeehiCMS File Upload Vulnerability
Summary
CVE-2024-8294: FeehiCMS file upload vulnerability. Affects feehi/cms versions < 2.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FeehiCMS is an open-source content management system (CMS) developed by Feehi. It is designed to provide a user-friendly interface for managing website content. The CMS allows users to create and manage friendly links, which are used to enhance website navigation and improve search engine optimization. FeehiCMS versions up to 2.1.1 are affected by a critical vulnerability that allows for unrestricted file upload. This vulnerability can be exploited remotely, potentially leading to unauthorized access and execution of malicious code. The vendor has been notified but has not responded to the disclosure.
Vulnerability Detail
The vulnerability in FeehiCMS arises from the 'update' function in the file '/admin/index.php?r=friendly-link%2Fupdate'. By manipulating the 'FriendlyLink[image]' argument, an attacker can bypass file upload restrictions and upload arbitrary files to the server. This can lead to various security risks, including remote code execution, data breaches, and unauthorized access to sensitive information. The exploit has been publicly disclosed, increasing the likelihood of attacks targeting vulnerable installations of FeehiCMS.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the file upload functionality in FeehiCMS until a patch is available. This can be achieved by modifying the application code or configuration to prevent the execution of the vulnerable 'update' function. However, this workaround may limit the CMS's functionality and should only be considered as a temporary measure.
Conclusion
FeehiCMS versions up to 2.1.1 are vulnerable to a critical file upload vulnerability. Attackers can exploit this vulnerability remotely, potentially leading to unauthorized access and execution of malicious code. It is crucial for users to update FeehiCMS to the latest version and apply any available patches or security updates. Disabling the file upload functionality can serve as a temporary workaround until a patch is available. Regularly checking for updates and maintaining the security of FeehiCMS installations is essential to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for feehi/cms →
FAQ
FeehiCMS is an open-source content management system (CMS) developed by Feehi. It provides a user-friendly interface for managing website content and includes features such as friendly links for improved navigation and search engine optimization.
The vulnerability allows for unrestricted file upload, which can lead to various security risks. Attackers can upload malicious files to the server, potentially enabling remote code execution, data breaches, and unauthorized access to sensitive information.
To fix this vulnerability, it is recommended to update FeehiCMS to the latest version available. The vendor should release a patch or security update addressing the file upload vulnerability. Regularly checking for updates and applying them promptly is crucial for maintaining the security of FeehiCMS installations.
As a temporary workaround, users can disable the file upload functionality in FeehiCMS until a patch is available. This can be achieved by modifying the application code or configuration to prevent the execution of the vulnerable 'update' function. However, this workaround may limit the CMS's functionality and should only be considered as a temporary measure.
Yes, the vendor has been notified about this vulnerability. However, they have not responded to the disclosure or provided any information regarding a patch or security update.
Related vulnerabilities
Recent vulnerabilities recorded for feehi/cms.
