CVE-2018-16352
📋 TL;DR
This vulnerability allows attackers to upload malicious PHP code disguised as PNG images to WeaselCMS, potentially leading to remote code execution. Any system running WeaselCMS 0.3.6 with file upload functionality enabled is affected. Attackers can bypass content type validation by embedding PHP code at the end of PNG files.
💻 Affected Systems
- WeaselCMS
📦 What is this software?
Weaselcms by Weaselcms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via remote code execution, allowing attackers to execute arbitrary commands, steal data, install malware, or pivot to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as a foothold for further attacks within the network.
If Mitigated
Limited impact with proper file upload restrictions, web application firewalls, and file integrity monitoring in place.
🎯 Exploit Status
Exploitation is straightforward - attackers simply need to create a PNG file with PHP code appended and upload it. The vulnerability is well-documented in public repositories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: None
Vendor Advisory: https://github.com/alterebro/WeaselCMS/issues/8
Restart Required: No
Instructions:
1. Check GitHub issue #8 for community fixes
2. Consider migrating to a maintained CMS
3. Apply manual code fixes to validate file extensions and content
🔧 Temporary Workarounds
Disable File Uploads
allCompletely disable file upload functionality in WeaselCMS
Modify WeaselCMS configuration to remove upload capabilities
Implement File Extension Validation
allAdd server-side validation to reject files with .php extension regardless of content type
Add file extension validation in index.php before processing uploads
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block suspicious file uploads
- Restrict upload directory permissions and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check if running WeaselCMS version 0.3.6 and test if PHP files can be uploaded as PNGsCheck Version:
Check WeaselCMS version in admin panel or configuration filesVerify Fix Applied:
Attempt to upload a PNG file with PHP code appended - it should be rejected📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads with PNG content type but .php extension
- Multiple failed upload attempts
- Files with mixed content types in upload logs
Network Indicators:
- HTTP POST requests to upload endpoints with PNG headers but PHP content
- Unusual traffic patterns to upload directories
SIEM Query:
source="web_logs" AND (uri_path="*upload*" OR uri_path="*index.php*") AND (content_type="image/png" AND file_extension=".php")