CVE-2018-14334
📋 TL;DR
This vulnerability allows attackers to upload arbitrary PHP files to joyplus-cms 1.6.0 due to improper file extension validation. Attackers can execute malicious code on the server, potentially gaining full control. All systems running joyplus-cms 1.6.0 with the upload functionality accessible are affected.
💻 Affected Systems
- joyplus-cms
📦 What is this software?
Joyplus Cms by Joyplus Cms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or use as a foothold for lateral movement.
Likely Case
Webshell upload allowing remote code execution, data exfiltration, and further system exploitation.
If Mitigated
Attack blocked at web application firewall or file upload prevented by proper validation.
🎯 Exploit Status
Simple file upload bypass with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/joyplus/joyplus-cms/issues/428
Restart Required: No
Instructions:
No official patch exists. Upgrade to a different CMS or apply manual fixes.
🔧 Temporary Workarounds
Disable upload.php
linuxRemove or restrict access to the vulnerable upload.php file.
mv manager/editor/upload.php manager/editor/upload.php.disabled
chmod 000 manager/editor/upload.php
Implement file validation
allAdd proper file extension validation and content checking to upload.php.
🧯 If You Can't Patch
- Implement strict file upload restrictions at web server level (e.g., .htaccess rules blocking .php uploads)
- Deploy web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check if joyplus-cms version is 1.6.0 and upload.php exists at manager/editor/upload.phpCheck Version:
Check CMS version in configuration files or admin panelVerify Fix Applied:
Test file upload functionality with PHP files - should be rejected with proper validation.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to upload.php
- PHP file uploads with suspicious names
- Multiple failed upload attempts
Network Indicators:
- POST requests to upload.php with PHP file content
- Unusual outbound connections after file upload
SIEM Query:
source="web.log" AND uri="/manager/editor/upload.php" AND (file_extension="php" OR content_type="application/x-php")