CVE-2020-10557
📋 TL;DR
This vulnerability allows authenticated users with low privileges to upload malicious PHP7 files through AContent's file manager, leading to remote code execution on the server. It affects AContent installations up to version 1.4. Attackers can execute arbitrary commands on the server with the web server's permissions.
💻 Affected Systems
- AContent
📦 What is this software?
Acontent by Atutor
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise allowing attackers to execute arbitrary commands, install backdoors, steal data, pivot to internal networks, or use the server for further attacks.
Likely Case
Attackers upload web shells to gain persistent access, deface websites, steal sensitive data, or use server resources for cryptocurrency mining or DDoS attacks.
If Mitigated
With proper file upload validation and server hardening, impact is limited to denial of service or temporary disruption if malicious files are uploaded but cannot be executed.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The .php7 extension bypasses existing file upload restrictions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Not specified
Vendor Advisory: https://sourceforge.net/projects/acontent/
Restart Required: No
Instructions:
1. Check for updates on the AContent SourceForge page
2. If no patch is available, implement workarounds
3. Consider upgrading to a maintained alternative if AContent is no longer supported
🔧 Temporary Workarounds
Block .php7 file uploads
allAdd .php7 to the list of blocked file extensions in upload validation
Modify upload.php to reject files with .php7 extension
Web server configuration hardening
linuxConfigure web server to not execute .php7 files as PHP
For Apache: Add 'AddType application/x-httpd-php .php' to .htaccess, explicitly excluding .php7
For Nginx: Remove .php7 from fastcgi_split_path_info or location ~ \.php$ block
🧯 If You Can't Patch
- Implement strict file upload validation that checks file content, not just extensions
- Restrict file upload permissions to only necessary users and monitor upload activity
🔍 How to Verify
Check if Vulnerable:
Check if you can upload a .php7 file through the file manager interface and access it via browser to execute codeCheck Version:
Check AContent version in admin panel or look for version files in installation directoryVerify Fix Applied:
Attempt to upload a .php7 test file - it should be rejected or not execute when accessed📡 Detection & Monitoring
Log Indicators:
- File uploads with .php7 extension in web server logs
- Unusual POST requests to upload.php
- Execution of unexpected PHP files
Network Indicators:
- HTTP requests to unusual .php7 files
- Outbound connections from web server to suspicious IPs
SIEM Query:
source="web_server" AND (uri="*.php7" OR uri="*/upload.php")