CVE-2020-18166
📋 TL;DR
This vulnerability allows remote attackers to upload arbitrary files to LAOBANCMS v2.0 by exploiting an unrestricted file upload flaw. Attackers can upload malicious PHP files disguised as images, potentially leading to remote code execution. Any organization running LAOBANCMS v2.0 with the vulnerable component exposed is affected.
💻 Affected Systems
- LAOBANCMS
📦 What is this software?
Laobancms by Laobancms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through remote code execution, allowing attackers to execute arbitrary commands, steal data, install backdoors, or pivot to other systems.
Likely Case
Webshell deployment leading to persistent access, data exfiltration, or website defacement.
If Mitigated
File uploads blocked or properly validated, limiting impact to failed upload attempts.
🎯 Exploit Status
Exploitation requires only web access and knowledge of the vulnerable endpoint. The .jpg.php extension bypasses basic file type checks.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Consider upgrading to a newer version if available, or implement workarounds.
🔧 Temporary Workarounds
Restrict file upload extensions
allModify the upload validation to reject files with double extensions like .jpg.php
Modify wenjian.php to validate file extensions strictly, rejecting any file with .php in the extension
Disable vulnerable component
linuxRemove or restrict access to admin/wenjian.php
mv admin/wenjian.php admin/wenjian.php.disabled
chmod 000 admin/wenjian.php
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block requests to admin/wenjian.php with file upload parameters
- Restrict network access to the LAOBANCMS admin interface using IP whitelisting
🔍 How to Verify
Check if Vulnerable:
Attempt to upload a test file with .jpg.php extension to admin/wenjian.php?wj=../templets/pc and check if it's saved.Check Version:
Check LAOBANCMS version in configuration files or admin panelVerify Fix Applied:
Attempt the same upload test; it should be rejected or saved with safe extension only.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to admin/wenjian.php with file uploads
- Files with .jpg.php extension appearing in templets/pc directory
Network Indicators:
- Unusual POST requests to admin endpoints with file uploads
- Traffic spikes to admin interface
SIEM Query:
source="web_logs" AND uri="/admin/wenjian.php" AND method="POST" AND (file_extension="php" OR user_agent contains "curl" OR user_agent contains "wget")