CVE-2023-46474
📋 TL;DR
This vulnerability in PMB v7.4.8 allows remote attackers to upload malicious PHP files through the start_import.php endpoint, leading to arbitrary code execution and privilege escalation. Any organization running the vulnerable version of PMB is affected.
💻 Affected Systems
- PMB (PhpMyBibli)
📦 What is this software?
Pmb by Sigb
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with attacker gaining full administrative control, data exfiltration, and persistent backdoor installation.
Likely Case
Unauthorized file upload leading to web shell deployment, data manipulation, and lateral movement within the network.
If Mitigated
Attack blocked at web application firewall or file upload validation layer with no impact.
🎯 Exploit Status
Public exploit code is available on GitHub, making exploitation trivial for attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 7.4.9 or later
Vendor Advisory: http://pmb.com
Restart Required: No
Instructions:
1. Backup your PMB installation and database. 2. Download the latest version from the official PMB website. 3. Replace the vulnerable files with patched versions. 4. Verify the update by checking the version number.
🔧 Temporary Workarounds
Restrict File Upload Types
allConfigure web server to block PHP file uploads to the import directory
# For Apache: Add to .htaccess in upload directory
<Files *.php>
Order Deny,Allow
Deny from all
</Files>
# For Nginx: Add to server block
location ~* \.php$ {
deny all;
}
Disable start_import.php
linuxTemporarily disable the vulnerable endpoint
mv /path/to/pmb/start_import.php /path/to/pmb/start_import.php.disabled
🧯 If You Can't Patch
- Implement strict file upload validation at the application layer
- Deploy a web application firewall with file upload protection rules
🔍 How to Verify
Check if Vulnerable:
Check if PMB version is 7.4.8 by examining the application interface or configuration files.Check Version:
grep -r 'version' /path/to/pmb/configuration/files/ or check PMB admin interfaceVerify Fix Applied:
Verify the version has been updated to 7.4.9 or later and test file upload functionality with PHP files.📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads to start_import.php
- PHP file uploads in web server access logs
- Multiple failed upload attempts
Network Indicators:
- HTTP POST requests to /start_import.php with file uploads
- Unusual outbound connections from web server
SIEM Query:
source="web_server_logs" AND (uri="/start_import.php" AND method="POST" AND file_extension="php")