CVE-2023-28731
📋 TL;DR
This vulnerability allows unauthenticated attackers to execute arbitrary PHP code on Joomla websites using the AnyMailing plugin. Attackers can upload malicious files through the front-end campaign creation feature, leading to complete system compromise. It affects AnyMailing Enterprise plugin versions below 8.3.0.
💻 Affected Systems
- AnyMailing Joomla Plugin Enterprise
📦 What is this software?
Acymailing by Acymailing
⚠️ Risk & Real-World Impact
Worst Case
Complete server takeover, data theft, malware deployment, and lateral movement to other systems.
Likely Case
Website defacement, data exfiltration, cryptocurrency mining, or ransomware deployment.
If Mitigated
Limited impact if file uploads are restricted or web application firewall blocks malicious payloads.
🎯 Exploit Status
Exploitation is straightforward with publicly available proof-of-concept code.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.3.0 and above
Vendor Advisory: https://www.acymailing.com/change-log/
Restart Required: No
Instructions:
1. Log into Joomla admin panel. 2. Navigate to Extensions > Manage > Update. 3. Update AnyMailing to version 8.3.0 or later. 4. Alternatively, download from acymailing.com and install manually.
🔧 Temporary Workarounds
Disable front-end campaign creation
allRemove front-office access to campaign creation features
Navigate to AnyMailing configuration and disable front-end campaign creation
Restrict file upload extensions
linuxConfigure web server to block PHP file uploads
Add to .htaccess: <FilesMatch "\.(php|php5|php7|phtml)$">
Order Allow,Deny
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Disable the AnyMailing plugin entirely until patching is possible
- Implement strict WAF rules to block file uploads containing PHP code
🔍 How to Verify
Check if Vulnerable:
Check Joomla admin panel > Extensions > Manage > Manage for AnyMailing version. If below 8.3.0, you are vulnerable.Check Version:
Check Joomla admin panel or database: SELECT * FROM #__extensions WHERE element LIKE '%acymailing%'Verify Fix Applied:
Confirm AnyMailing version is 8.3.0 or higher in Joomla extensions manager.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to AnyMailing directories
- PHP execution from upload directories
- Multiple failed upload attempts
Network Indicators:
- POST requests to AnyMailing upload endpoints with PHP content
- Outbound connections from web server to unknown IPs
SIEM Query:
source="web_logs" AND (uri_path="/index.php?option=com_acymailing" AND method="POST" AND file_upload="true")