CVE-2020-22937
📋 TL;DR
This vulnerability allows remote attackers to execute arbitrary PHP code on EmpireCMS 7.5 installations by writing malicious code to the install.php file. Attackers can achieve complete system compromise without authentication. All EmpireCMS 7.5 installations with the default install script accessible are affected.
💻 Affected Systems
- EmpireCMS
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover with attacker gaining full control over the web server, database, and underlying operating system, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, defacement, and use of the compromised server for further attacks.
If Mitigated
Limited impact if install script is properly removed after installation, with attackers unable to reach the vulnerable endpoint.
🎯 Exploit Status
Exploitation is trivial and requires no authentication. Public proof-of-concept code is available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.5 with install script removal or later versions
Vendor Advisory: https://github.com/leadscloud/EmpireCMS/issues/4
Restart Required: No
Instructions:
1. Immediately delete the /e/install/ directory and all its contents. 2. Verify the directory is completely removed from the web root. 3. Consider upgrading to the latest EmpireCMS version if available.
🔧 Temporary Workarounds
Remove Install Directory
linuxDelete the vulnerable install directory to prevent exploitation
rm -rf /path/to/empirecms/e/install/
Block Access via Web Server
allConfigure web server to deny all access to the install directory
# Apache: Add 'Deny from all' to .htaccess in /e/install/
# Nginx: Add 'location /e/install/ { deny all; }' to server config
🧯 If You Can't Patch
- Implement strict network segmentation to isolate the EmpireCMS server
- Deploy web application firewall (WAF) rules to block requests to /e/install/ paths
🔍 How to Verify
Check if Vulnerable:
Check if /e/install/index.php exists and is accessible via web browser or curl: curl -I http://yoursite.com/e/install/index.phpCheck Version:
Check EmpireCMS version in admin panel or read version.txt in installation directoryVerify Fix Applied:
Confirm /e/install/ directory no longer exists and returns 404/403 when accessed📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /e/install/index.php with POST parameters containing PHP code
- Unusual file creation in web root directory
- Suspicious PHP process execution
Network Indicators:
- Outbound connections from web server to unknown IPs shortly after access to install script
- Large data exfiltration from database server
SIEM Query:
source="web_access.log" AND uri="/e/install/index.php" AND (method="POST" OR status=200)