CWE-434

{
  "affected": [],
  "aliases": [
    "CVE-2024-42780"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-08-21T18:15:10Z",
    "severity": "HIGH"
  },
  "details": "An Unrestricted file upload vulnerability was found in \"/music/ajax.php?action=save_genre\" in Kashipara Music Management System v1.0. This allows attackers to execute arbitrary code via uploading a crafted PHP file.",
  "id": "GHSA-94m4-2jpq-9j4w",
  "modified": "2024-08-22T21:31:29Z",
  "published": "2024-08-21T18:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-42780"
    },
    {
      "type": "WEB",
      "url": "https://github.com/takekaramey/CVE_Writeup/blob/main/Kashipara/Music%20Management%20System%20v1.0/Unrestricted%20File%20Upload%20-%20Add%20New%20Genre.pdf"
    },
    {
      "type": "WEB",
      "url": "https://www.kashipara.com/project/php/12978/music-management-system-in-php-php-project-source-code"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2022-30007"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-05-17T16:15:00Z",
    "severity": "HIGH"
  },
  "details": "GXCMS V1.5 has a file upload vulnerability in the background. The vulnerability is the template management page. You can edit any template content and then rename to PHP suffix file, after calling PHP file can control the server.",
  "id": "GHSA-94q5-cf9v-236j",
  "modified": "2024-04-23T21:30:32Z",
  "published": "2022-05-18T00:00:37Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30007"
    },
    {
      "type": "WEB",
      "url": "https://github.com/breezety/gxcms15/issues/1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/ZackSecurity/VulnerReport/blob/cve/gxcms/1.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2024-46377"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-09-18T21:15:13Z",
    "severity": "CRITICAL"
  },
  "details": "Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the save_settings() function of the file rental/admin_class.php.",
  "id": "GHSA-94r8-x6vr-vvc4",
  "modified": "2024-09-19T18:30:51Z",
  "published": "2024-09-18T21:30:48Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-46377"
    },
    {
      "type": "WEB",
      "url": "https://github.com/gaorenyusi/gaorenyusi/blob/main/CVE-2024-46377.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-13038"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-07-01T18:29:00Z",
    "severity": "CRITICAL"
  },
  "details": "OpenSID 18.06-pasca has an Unrestricted File Upload vulnerability via an Attachment Document in the article feature. This vulnerability leads to uploading arbitrary PHP code via a .php filename with the application/pdf Content-Type.",
  "id": "GHSA-94rc-fxwq-q3h5",
  "modified": "2022-05-13T01:07:07Z",
  "published": "2022-05-13T01:07:07Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-13038"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenSID/OpenSID/issues/1177"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-24248"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-05-06T13:15:00Z",
    "severity": "HIGH"
  },
  "details": "The Business Directory Plugin \u00e2\u20ac\u201c Easy Listing Directories for WordPress WordPress plugin before 5.11.1 did not properly check for imported files, forbidding certain extension via a blacklist approach, allowing administrator to import an archive with a .php4 inside for example, leading to RCE",
  "id": "GHSA-954q-pwww-w7g3",
  "modified": "2022-05-24T22:28:28Z",
  "published": "2022-05-24T22:28:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24248"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/ca886a34-cd2b-4032-9de1-8089b5cf3001"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-43936"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-12-06T18:15:00Z",
    "severity": "CRITICAL"
  },
  "details": "The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product\u0027s environment or lead to arbitrary code execution.",
  "id": "GHSA-9558-55mx-wf4p",
  "modified": "2022-04-13T00:01:14Z",
  "published": "2021-12-07T00:00:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-43936"
    },
    {
      "type": "WEB",
      "url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-336-03"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/165252/WebHMI-4.0-Remote-Code-Execution.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2025-1834"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-02T22:15:34Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability, which was classified as critical, was found in zj1983 zz up to 2024-8. This affects an unknown part of the file /resolve. The manipulation of the argument file leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
  "id": "GHSA-9563-qrch-r2xp",
  "modified": "2025-03-03T00:30:51Z",
  "published": "2025-03-03T00:30:51Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-1834"
    },
    {
      "type": "WEB",
      "url": "https://github.com/caigo8/CVE-md/blob/main/zz/zz_resolve%E6%8E%A5%E5%8F%A3%E4%BB%BB%E6%84%8F%E6%96%87%E4%BB%B6%E4%B8%8A%E4%BC%A0.md"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?ctiid.298101"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?id.298101"
    },
    {
      "type": "WEB",
      "url": "https://vuldb.com/?submit.504842"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-36298"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-08-03T15:15:28Z",
    "severity": "HIGH"
  },
  "details": "DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).",
  "id": "GHSA-9566-3gww-45ch",
  "modified": "2024-04-04T06:31:36Z",
  "published": "2023-08-03T18:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-36298"
    },
    {
      "type": "WEB",
      "url": "https://github.com/MentalityXt/Dedecms-v5.7.109-RCE"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.6"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "admidio/admidio"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.0.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-32756"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-16T21:16:50Z",
    "nvd_published_at": "2026-03-20T00:16:16Z",
    "severity": "HIGH"
  },
  "details": "### **Summary**\n\nA critical unrestricted file upload vulnerability exists in the Documents \u0026 Files module of Admidio. Due to a design flaw in how CSRF token validation and file extension verification interact within `UploadHandlerFile.php`, an authenticated user with upload permissions can bypass file extension restrictions by intentionally submitting an invalid CSRF token. This allows the upload of arbitrary file types, including PHP scripts, which may lead to Remote Code Execution (RCE) on the server.\n\n### **Details**\n\n**1. Critical - Unrestricted File Upload leading to Remote Code Execution (RCE)**\n\n**Root Cause Analysis:**\n\nThe root cause lies in a design flaw in `src/Infrastructure/Plugins/UploadHandlerFile.php`. The `UploadHandlerFile` class overrides two methods from its parent `UploadHandler` class:\n\n- `handle_form_data($file, $index)` \u2014 Validates the CSRF token. On failure, it sets `$file-\u003eerror` and returns. The request is **not** terminated.\n- `handle_file_upload(...)` \u2014 Calls `parent::handle_file_upload()` to physically write the file to disk, then checks `if (!isset($file-\u003eerror))` before running file extension validation (`allowedFileExtension()`).\n\nThe execution flow differs based on whether the CSRF token is valid:\n\n- **Valid CSRF token**: `handle_form_data()` does not set an error \u2192 extension check runs \u2192 invalid extension causes the uploaded file to be deleted from disk.\n- **Invalid CSRF token**: `handle_form_data()` sets `$file-\u003eerror` \u2192 the `if (!isset($file-\u003eerror))` guard in `handle_file_upload()` causes the extension validation to be skipped entirely \u2192 the cleanup code (`FileSystemUtils::deleteFileIfExists()`) is never reached \u2192 the file, already written to disk by the parent class, remains on the server and is directly accessible.\n\nIn summary, the file is always saved to disk by the parent class first. The extension check and cleanup only execute when no prior error exists. A deliberate CSRF token failure bypasses the extension filter while the file remains on disk.\n\n**Affected code** (`src/Infrastructure/Plugins/UploadHandlerFile.php`):\n\n```php\n// File is physically saved to disk here, before any Admidio-specific checks\n$file = parent::handle_file_upload($uploaded_file, $name, $size, $type, $error, $index, $content_range);\n\nif (!isset($file-\u003eerror)) {\n    // Extension validation is only reached when no prior error is set.\n    // If CSRF validation failed in handle_form_data(), this block is skipped\n    // and the uploaded file is never cleaned up from disk.\n    if (!$newFile-\u003eallowedFileExtension()) {\n        throw new Exception(\u0027SYS_FILE_EXTENSION_INVALID\u0027);\n    }\n}\n```\n\n### **PoC**\n\nDocuments \u0026 Files Create folder\n\u003cimg width=\"762\" height=\"729\" alt=\"image\" src=\"https://github.com/user-attachments/assets/2c927482-851b-4945-93d6-6e7a1e3bc21f\" /\u003e\n\n\u003cimg width=\"749\" height=\"690\" alt=\"image\" src=\"https://github.com/user-attachments/assets/72443c87-e15f-4312-9659-8cd0661a4dae\" /\u003e\n\n\nFile Upload Try 1-1 (before request)\n\u003cimg width=\"1856\" height=\"635\" alt=\"image\" src=\"https://github.com/user-attachments/assets/d1ffaa12-aec1-45ff-a612-885d9554fb60\" /\u003e\n\n\nFile Upload Try 1-2 (after request)\n\u003cimg width=\"1850\" height=\"855\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4ece4aac-1255-4189-9048-45ff3df4abcf\" /\u003e\n\n\n\nFile Upload Try 1-3 (After changing CSRF to a test value, request \u2192 PHP file upload succeeds)\n\u003cimg width=\"1847\" height=\"928\" alt=\"image\" src=\"https://github.com/user-attachments/assets/63f9d108-5e4f-4d32-96d2-09f9ad910873\" /\u003e\n\n\n\u2705 rcepoc.php Upload Success!\n\u003cimg width=\"926\" height=\"814\" alt=\"image\" src=\"https://github.com/user-attachments/assets/4de99c31-dc3c-44f2-9936-19c3da0dfffb\" /\u003e\n\n\nAccess the rcepoc upload path confirmed in the response and check the web shell.\n\u003cimg width=\"1635\" height=\"922\" alt=\"image\" src=\"https://github.com/user-attachments/assets/0b770caf-e737-4cbd-97b9-ae191a8b79f5\" /\u003e\n\n\n\ud83c\udd97\u00a0WebShell Success\n\u003cimg width=\"685\" height=\"187\" alt=\"image\" src=\"https://github.com/user-attachments/assets/e90f162b-7949-41c4-9fd1-aad3b6365adf\" /\u003e\n\n\u003cimg width=\"794\" height=\"209\" alt=\"image\" src=\"https://github.com/user-attachments/assets/f45dae74-a830-4761-af31-f2ac28eb2586\" /\u003e\n\n\n**Steps to Reproduce:**\n\n1. Log in to Admidio as an authenticated user with upload permissions on the Documents \u0026 Files module.\n2. Navigate to a folder in the Documents \u0026 Files module and open the file upload dialog.\n3. Intercept the upload POST request to `/system/file_upload.php?module=documents_files\u0026mode=upload_files\u0026uuid=\u003cfolder_uuid\u003e` using a proxy tool such as Burp Suite.\n4. Replace the value of the `adm_csrf_token` field with an arbitrary invalid string (e.g., `webshellgogo`).\n5. Set the file to be uploaded to a PHP webshell (e.g., `\u003c?php system($_GET[1]); ?\u003e`).\n6. Forward the modified request.\n7. Observe that the server responds with HTTP `200 OK`. The JSON body contains `\"error\":\"Invalid or missing CSRF token!\"`, yet the file is physically present on the server at the path indicated in the `url` field.\n8. Access the uploaded PHP file directly via the URL provided in the response \u2014 arbitrary command execution is confirmed.\n\n### **Impact**\n\n- An authenticated attacker with upload permissions can bypass file extension validation and upload arbitrary server-side scripts such as PHP webshells.\n- This leads to Remote Code Execution (RCE), potentially resulting in full server compromise, sensitive data exfiltration, and lateral movement.\n- While authentication is required, the attack is not limited to administrators \u2014 any member granted upload rights may exploit this vulnerability, making the attack surface broader than it may initially appear.\n\n### **Remediation Measures**\n\n- The extension validation logic should be executed independently of the CSRF error state. It is recommended to move the extension check and the corresponding cleanup outside of the `if (!isset($file-\u003eerror))` block so that files with disallowed extensions are always removed from disk, regardless of other errors.\n- Rather than relying on a blacklist of dangerous extensions (e.g., `.php`, `.phar`, `.phtml`), it is strongly recommended to implement a **whitelist** of permitted extensions appropriate to a documents module (e.g., `.pdf`, `.docx`, `.xlsx`, `.pptx`, `.txt`).\n- CSRF token validation should either be performed before the file is written to disk, or a validation failure should result in immediate request termination rather than merely setting an error flag on the file object.",
  "id": "GHSA-95cq-p4w2-32w5",
  "modified": "2026-03-20T21:15:25Z",
  "published": "2026-03-16T21:16:50Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/security/advisories/GHSA-95cq-p4w2-32w5"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32756"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Admidio/admidio"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Admidio/admidio/releases/tag/v5.0.7"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "File Upload(RCE) Vulnerability in admidio"
}

{
  "affected": [],
  "aliases": [
    "CVE-2023-3032"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-434"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-06-02T13:15:10Z",
    "severity": "HIGH"
  },
  "details": "Unrestricted Upload of File with Dangerous Type vulnerability in Mobatime web application (Documentary proof upload modules) allows a malicious user to Upload a Web Shell to a Web Server.This issue affects Mobatime web application: through 06.7.22.\n\n",
  "id": "GHSA-95gq-vgg7-x3mr",
  "modified": "2024-04-04T04:28:57Z",
  "published": "2023-06-02T15:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3032"
    },
    {
      "type": "WEB",
      "url": "https://borelenzo.github.io/stuff/2023/06/01/cve-2023-3032.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
      "type": "CVSS_V3"
    }
  ]
}