CVE-2020-23790
📋 TL;DR
This vulnerability allows unauthenticated attackers to upload arbitrary files to servers running the Golo Laravel theme v1.1.5. This can lead to remote code execution and complete system compromise. Any website using this vulnerable theme version is affected.
💻 Affected Systems
- Golo City Guide Laravel Theme
📦 What is this software?
Golo by Uxper
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover via web shell upload leading to data theft, ransomware deployment, or use as attack infrastructure.
Likely Case
Web shell installation allowing persistent backdoor access, data exfiltration, and lateral movement within the network.
If Mitigated
File upload attempts blocked or quarantined with no successful exploitation.
🎯 Exploit Status
Public exploit script available on GitHub demonstrating file upload bypass.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v1.1.6 or later
Vendor Advisory: https://codecanyon.net/item/golo-city-guide-laravel-theme/25785389
Restart Required: No
Instructions:
1. Download latest version from CodeCanyon. 2. Backup current installation. 3. Replace theme files with patched version. 4. Verify file upload restrictions are properly implemented.
🔧 Temporary Workarounds
File Upload Restriction
allImplement server-side file type validation and extension filtering
# Add to .htaccess: php_value upload_max_filesize 2M
# Add file type validation in PHP
Web Application Firewall
linuxDeploy WAF rules to block malicious file upload patterns
# ModSecurity rule: SecRule FILES "@rx \.(php|phtml|phar)$" "deny,status:403"
🧯 If You Can't Patch
- Disable file upload functionality completely in theme settings
- Implement strict file permission controls (chmod 644 for uploads directory)
🔍 How to Verify
Check if Vulnerable:
Check theme version in admin panel or composer.json. If version is 1.1.5, test file upload with malicious extensions.Check Version:
grep -r "version.*1.1.5" /path/to/laravel/themes/ || php artisan --versionVerify Fix Applied:
Attempt to upload PHP file with .php extension - should be rejected. Verify theme version shows 1.1.6+.📡 Detection & Monitoring
Log Indicators:
- POST requests to upload endpoints with PHP files
- Files with .php extension in upload directories
- Large number of 200 responses from upload endpoints
Network Indicators:
- Unusual outbound connections from web server
- POST requests with file uploads to unexpected paths
SIEM Query:
source="web_logs" AND (uri_path="*upload*" OR uri_path="*file*" ) AND (http_method="POST") AND (status=200) AND (file_extension="php" OR file_extension="phtml")🔗 References
- https://codecanyon.net/item/golo-city-guide-laravel-theme/25785389
- https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-02-golo-business-listing-city-travel-guide-laravel-theme-v1-1-5.txt
- https://codecanyon.net/item/golo-city-guide-laravel-theme/25785389
- https://github.com/vladvector/vladvector.github.io/blob/master/exploit/2020-07-02-golo-business-listing-city-travel-guide-laravel-theme-v1-1-5.txt
