CVE-2021-26794
📋 TL;DR
This vulnerability allows attackers to upload malicious PHP files through the upload.php script in FrogCMS SentCMS, leading to remote code execution and privilege escalation. Any organization running vulnerable versions of FrogCMS SentCMS is affected, particularly those with internet-facing installations.
💻 Affected Systems
- FrogCMS SentCMS
📦 What is this software?
Frogcms by Frogcms Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full control over the web server, potentially leading to data theft, ransomware deployment, or lateral movement within the network.
Likely Case
Webshell deployment allowing persistent access, data exfiltration, and further exploitation of the compromised system.
If Mitigated
Attack blocked at web application firewall level or file upload restrictions preventing PHP execution.
🎯 Exploit Status
Simple file upload vulnerability requiring only HTTP POST requests. Public GitHub issues demonstrate the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v0.9.6 or later
Vendor Advisory: https://github.com/philippe/FrogCMS/issues/11
Restart Required: No
Instructions:
1. Backup current installation. 2. Download latest version from official repository. 3. Replace upload.php with patched version. 4. Verify file upload restrictions are properly implemented.
🔧 Temporary Workarounds
Disable upload.php
linuxTemporarily disable or remove the vulnerable upload.php script
mv upload.php upload.php.disabled
chmod 000 upload.php
Restrict file uploads
allConfigure web server to block PHP file uploads via upload.php
Add 'Deny from all' to .htaccess for upload.php directory
🧯 If You Can't Patch
- Implement strict file upload validation at web application firewall level
- Disable PHP execution in upload directories using server configuration
🔍 How to Verify
Check if Vulnerable:
Check if upload.php exists and allows PHP file uploads without proper validation. Test by attempting to upload a PHP file.Check Version:
Check FrogCMS version in admin panel or read version file if presentVerify Fix Applied:
Attempt to upload a PHP file through upload.php - should be rejected. Verify upload.php has proper file type validation.📡 Detection & Monitoring
Log Indicators:
- Multiple failed/successful file upload attempts to upload.php
- PHP file uploads through upload.php endpoint
- Unusual POST requests to upload.php
Network Indicators:
- HTTP POST requests to /upload.php with PHP file content
- Unusual outbound connections from web server after file upload
SIEM Query:
source="web_logs" AND uri="/upload.php" AND (method="POST" OR file_extension="php")