Hacked by a JPEG: MoziloCMS 3.0’s Comedy of Errors in RCE Vulnerability!
MoziloCMS 3.0 is experiencing a midlife crisis with an arbitrary file upload vulnerability. Authenticated attackers can upload a sneaky .JPG, rename it to .PHP, and voilà — remote code execution (RCE) is served! If only all bugs were this hospitable. Remember, with great power comes great responsibility… and perhaps a new CMS.
Hot Take:
Who knew that a simple .JPG file could turn into a full-blown party crasher for MoziloCMS? Instead of just storing your family vacation photos, it’s now moonlighting as a gateway for mischievous hackers. Looks like MoziloCMS 3.0 has taken the phrase “a picture is worth a thousand words” to a whole new level, where those words are PHP code!
Key Points:
- MoziloCMS 3.0 vulnerable to arbitrary file upload, allowing RCE.
- Authenticated users can exploit this via the “/admin/index.php” component.
- Attackers can upload a .JPG with embedded PHP code and rename it to .PHP.
- Exploiting this flaw can lead to unauthorized code execution on the server.
- CVE for this vulnerability is CVE-2024-44871.
Already a member? Log in here