Before GetSimpleCMS 3.3.16 version upload.php allowed to upload executable files lead to RCE

[Cyc1e183]

Affected version: GetSimpleCMS before 3.3.16.

Vulnerable file: /admin/upload.php.

Causes of vulnerability : upload.php does not allow direct uploading of ph* type files, and it fails when directly uploading ph* files.

However, you can bypass the detection by uploading a phar file and adding picture file header information such as jpg to the file to successfully upload the phar file.

Because the phar file can be parsed normally after php7.2, you can directly upload the php webshell with the phar suffix.

Repair suggestion: add the ph* file to the upload blacklist

[tablatronix]

• update blacklist mime type
• update blacklist file type
• update blacklist execution htaccess
• add common whitelist to push users to use that instead and make it easier to turn on
• rewrite this aweful htaccess FilesMatch format.. da fuq? <FilesMatch "\.(([pP][hH][pP][0-9]?)|([pP][hH

Mitigation

User local define GLOBAL $file_ext_whitelist in configuration.php to override blacklists

[Cyc1e183]

If installed in the php5.6 or php7.0 environment, the php7 suffix can also be used to construct and upload getshell, and php7 should also be added to the blacklist