CVE-2018-16974 (PHP, published 2018-09-12T21:29Z)
Description: value: An issue was discovered in Elefant CMS before 2.0.7. There is a PHP Code Execution Vulnerability in apps/filemanager/upload/drop.php by using /filemanager/api/rm/.htaccess to remove the .htaccess file, and then using a filename that ends in .php followed by space characters (for bypassing the blacklist).
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-434 \u2014 Unrestricted Upload of File with Dangerous Type
The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Repository: https://github.com/jbroadway/elefant
Files changed:
apps/filemanager/handlers/embed.php
apps/filemanager/handlers/redactor/upload.php
apps/filemanager/handlers/upload.php
apps/filemanager/handlers/upload/drop.php
apps/filemanager/lib/API.php
apps/filemanager/lib/FileManager.php
Commit message: Fixed filemanager file upload validations, re: #287


Vulnerable code:
		if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe)$/i', $_POST['newName'])) {
$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'])) {
	$_FILES['file']['name'][$i] = urldecode ($_FILES['file']['name'][$i]);
	if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'][$i])) {
$_FILES['file']['name'] = urldecode ($_FILES['file']['name']);
if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe)$/i', $_FILES['file']['name'])) {
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		$file = urldecode (join ('/', func_get_args ()));
		if (preg_match ('/\.php$/i', $name)) {

Fixed code:
		$_POST['newName'] = trim ($_POST['newName']);
		
		if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe|htaccess|htpasswd)$/i', $_POST['newName'])) {
$_FILES['file']['name'] = trim (urldecode ($_FILES['file']['name']));
if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe|htaccess|htpasswd)$/i', $_FILES['file']['name'])) {
	$_FILES['file']['name'][$i] = trim (urldecode ($_FILES['file']['name'][$i]));
	if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe|htaccess|htpasswd)$/i', $_FILES['file']['name'][$i])) {
$_FILES['file']['name'] = trim (urldecode ($_FILES['file']['name']));
if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe|htaccess|htpasswd)$/i', $_FILES['file']['name'])) {
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		$file = trim (urldecode (join ('/', func_get_args ())));
		} elseif (! self::verify_file_name ($file)) {
			self::$error = __ ('Invalid file name');
			return false;
		if (preg_match ('/\.(php|phtml|pht|php3|php4|php5|phar|js|rb|py|pl|sh|bash|exe|htaccess|htpasswd)$/i', $name)) {