CVE-2020-21325
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary code on WUZHI CMS systems via an unsafe file upload mechanism in the set_chache method. Attackers can upload malicious files that get executed on the server. All users running vulnerable versions of WUZHI CMS are affected.
💻 Affected Systems
- WUZHI CMS
📦 What is this software?
Wuzhicms by Wuzhicms
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary commands, steal data, install backdoors, or pivot to other systems.
Likely Case
Webshell deployment leading to data theft, defacement, or use as part of a botnet.
If Mitigated
Attack blocked at WAF level or file upload prevented, resulting in no impact.
🎯 Exploit Status
The GitHub issue shows exploitation details and the vulnerability is straightforward to exploit.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after v4.1.0
Vendor Advisory: https://github.com/wuzhicms/wuzhicms/issues/188
Restart Required: No
Instructions:
1. Upgrade to the latest version of WUZHI CMS. 2. Replace the vulnerable function\common.func.php file with the patched version. 3. Verify the set_chache method has proper file validation.
🔧 Temporary Workarounds
File Upload Restriction
allRestrict file uploads to the cache directory and implement strict file type validation.
# Modify PHP configuration to restrict upload directories
# Add file extension validation in application code
WAF Rule Implementation
allDeploy web application firewall rules to block malicious file upload attempts.
# Example ModSecurity rule: SecRule ARGS "@rx \.(php|phtml)" "id:1001,deny"
🧯 If You Can't Patch
- Implement strict file upload validation in the set_chache method to only allow safe file types.
- Restrict PHP execution in the cache directory using .htaccess or server configuration.
🔍 How to Verify
Check if Vulnerable:
Check if your WUZHI CMS version is 4.1.0 and examine the function\common.func.php file for the set_chache method without proper file validation.Check Version:
Check the version.php file or admin panel for version information.Verify Fix Applied:
Verify the set_chache method now validates file extensions and restricts uploads to safe file types only.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to cache directory
- PHP file execution from cache directory
- Webshell-like file names in upload logs
Network Indicators:
- POST requests with file uploads to vulnerable endpoints
- Unexpected outbound connections from web server
SIEM Query:
source="web_logs" AND (uri="/function/common.func.php" OR file_upload="*.php")