Vulnerability: SOY CMS 3.0.2 and earlier is affected by Remote Code Execution (RCE) using Unrestricted File Upload. Cross-Site Scripting(XSS) vulnerability that was used in CVE-2020-15183 can be used to increase impact by redirecting the administrator to access a specially crafted page. This vulnerability is caused by insecure configuration in elFinder. This is fixed in version 3.0.2.328.
Vulnerability ID: CVE-2020-15189
CWE: CWE-434
Severity score: 6.4
Project: https://github.com/inunosinsi/soycms
Published: 2020-09-18
File: cms/soycms/js/elfinder/php/connector.php
Commit message: Block from uploading PHP files to elFinder
Commit author: stypr

Vulnerable version (before fix):
 function access($attr, $path, $data, $volume, $isDir, $relpath) { 			'uploadDeny'    => array('all'),                // All Mimetypes not allowed to upload 			'uploadAllow'   => array('image', 'text/plain', 'text/css', 'application/zip', 'application/epub+zip','application/pdf'),// Mimetype `image` and `text/plain` allowed to upload 			'uploadOrder'   => array('deny', 'allow'),      // allowed Mimetype `image` and `text/plain` only 			'accessControl' => 'access'                     // disable and hide dot starting files (OPTIONAL) 		), 	) );

Fixed version (after fix):
 function access($attr, $path, $data, $volume, $isDir, $relpath) { 			'uploadDeny'    => array('all'),                // All Mimetypes not allowed to upload 			'uploadAllow'   => array('image', 'text/plain', 'text/css', 'application/zip', 'application/epub+zip','application/pdf'),// Mimetype `image` and `text/plain` allowed to upload 			'uploadOrder'   => array('deny', 'allow'),      // allowed Mimetype `image` and `text/plain` only 			'accessControl' => 'access',                     // disable and hide dot starting files (OPTIONAL) 			'attributes' => array(                                 //フロントコントローラー                                 array(                                       	'pattern' => '/\\.php(\\.old(\\.[0-9][0-9])?)?$/',                                         'read' => false,                                         'write' => false,                                         'locked' => true,                                         'hidden' => true,                                 ),                         ) 		), 	) );

Patch:
patch: @@ -153,7 +153,17 @@ function access($attr, $path, $data, $volume, $isDir, $relpath) {
 			'uploadDeny'    => array('all'),                // All Mimetypes not allowed to upload
 			'uploadAllow'   => array('image', 'text/plain', 'text/css', 'application/zip', 'application/epub+zip','application/pdf'),// Mimetype `image` and `text/plain` allowed to upload
 			'uploadOrder'   => array('deny', 'allow'),      // allowed Mimetype `image` and `text/plain` only
-			'accessControl' => 'access'                     // disable and hide dot starting files (OPTIONAL)
+			'accessControl' => 'access',                     // disable and hide dot starting files (OPTIONAL)
+			'attributes' => array(
+                                //フロントコントローラー
+                                array(
+                                      	'pattern' => '/\\.php(\\.old(\\.[0-9][0-9])?)?$/',
+                                        'read' => false,
+                                        'write' => false,
+                                        'locked' => true,
+                                        'hidden' => true,
+                                ),
+                        )
 		),
 	)
 );
path: cms/soycms/js/elfinder/php/connector.php