CVE-2024-8296: FeehiCMS User[avatar] Unrestricted Upload
Summary
CVE-2024-8296: FeehiCMS User[avatar] unrestricted upload. Affects feehi/cms versions < 2.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
FeehiCMS is an open-source content management system (CMS) developed by Feehi. It provides a platform for creating and managing websites, allowing users to easily publish and organize content. The CMS includes various features such as user management, file uploads, and customizable themes. However, FeehiCMS versions up to 2.1.1 are vulnerable to an unrestricted upload issue in the 'insert' function of the '/admin/index.php?r=user%2Fcreate' file. This vulnerability allows remote attackers to upload files without any restrictions, potentially leading to further exploitation of the system.
Vulnerability Detail
The vulnerability in FeehiCMS arises from the manipulation of the 'User[avatar]' argument in the 'insert' function. By exploiting this issue, an attacker can upload files to the system without any restrictions. This can have severe consequences, as the uploaded files may contain malicious code or unauthorized content. The vulnerability has been classified as critical due to its potential for remote exploitation. Although the vendor was notified about the issue, no response was received, and the exploit has been publicly disclosed.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can disable the file upload functionality in FeehiCMS until a patch is available. This can be done by modifying the application code or configuration to restrict access to the file upload feature. Here is an example of how to disable file uploads in FeehiCMS:
- Open the '/admin/index.php' file.
- Locate the 'user/create' function.
- Comment out or remove the code responsible for handling file uploads.
- Save the changes and restart the application.
Conclusion
FeehiCMS versions up to 2.1.1 are vulnerable to an unrestricted upload issue, allowing remote attackers to upload files without any restrictions. This can lead to the execution of malicious code, unauthorized access, or the dissemination of malicious content. It is crucial to update FeehiCMS to a version beyond 2.1.1 and implement proper file upload validation and security measures to mitigate this vulnerability.
See every vulnerability recorded for feehi/cms →
FAQ
FeehiCMS is an open-source content management system (CMS) developed by Feehi. It provides a platform for creating and managing websites, allowing users to easily publish and organize content.
The vulnerability allows remote attackers to upload files without any restrictions. This can lead to the execution of malicious code, unauthorized access, or the dissemination of malicious content.
Yes, the vendor was contacted about this vulnerability. However, they did not respond or provide any fix or mitigation measures.
To protect your FeehiCMS installation, it is recommended to update to a version beyond 2.1.1, which should include a patch for this vulnerability. Additionally, ensure that proper file upload validation and security measures are implemented in your application.
Yes, as a temporary workaround, you can disable the file upload functionality in FeehiCMS until a patch is available. Instructions for disabling file uploads can be found in the 'workaround' section of this report.
Related vulnerabilities
Recent vulnerabilities recorded for feehi/cms.
