Upload file to RCE in Zenario CMS 9.0.54156

[hieuminhnv]

Summary
hi team,
I found high Upload file to RCE.

Info
Zenario CMS 9.0.54156 last version
FireFox 92.0.1 (64-bit)

Steps

1. Login to account http://xxx.xxx.x.x/admin.php?cID=1&cType=html
   

2. Choose Documents >> Upload documents
   

3. Use burpsuite and capture request file a.html
   

4. Click Edit document metadata >> use burpsuite to capture >> save
   

5. In value current_value, edit value html to php
   

6. Click Actions >> view public link
   

7.Copy link to URL >> BOOM

Inpact :
An attacker could upload a dangerous executable file like a virus, malware, etc..
The web server can be compromised by uploading and executing a web-shell which can run commands, browse system files, browse local resources, attack other servers, and exploit the local vulnerabilities, and so forth.