phpMyFAQ's File Upload Bypass at Category Image Leads to RCE
Date: 2024-03
Affected: composer/phpmyfaq/phpmyfaq
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2024-28105
CWE: CWE-434
CVSS: 7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)

### Summary The category image upload function in phpmyfaq is vulnerable to manipulation of the `Content-type` and `lang` parameters, allowing attackers to upload malicious files with a .php extension, potentially leading to remote code execution (RCE) on the system. ### Details In the file upload function of the category image, the `Content-type` can be manipulated to return an empty string for the extension and the `lang` parameter can be set to `.php.` to allow an attacker to save a file as `.PHP`. This allows the uploading of web shells which could lead to RCE on phpmyfaq. ### PoC 1. Generate a fake .GIF file that contains a php command using the tool `gifsicle` a. Cmd: `gifsicle < test1.gif --comment "<?php system('whoami'); ?>" > output.php.gif` ![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/b9fc1f37-ce83-4ec5-88a5-5217c35caac9) b. The contents of the file should look like this: ![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/6d64a5b9-238f-4b56-8de6-7a765f69b0f5) 2. Browse to “../phpmyfaq/admin/?action=addcategory” and upload the fake .GIF file ![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/680f1c94-c4eb-4873-be05-018e745b88b2) 3. Intercept the upload request and modify the params below and forward it: 3a. `lang` parameter to `.php.` 3b. `Content-Type` parameter from `image/gif` to `image/gif2` ![image](https://github.com/thorsten/phpMyFAQ/assets/63487456/9247c5bb-8f58-41de-a5d4-83


Mitigations:

Architectural layers (MAESTRO):