CyberRota Analysis
AI-GeneratedUnoPim versions prior to 2.1.5 are vulnerable to an authenticated file upload flaw that permits authenticated administrators to upload arbitrary PHP files via the TinyMCE image upload endpoint, due to inadequate validation of file extensions and MIME types. This vulnerability enables attackers to upload a PHP web shell, allowing them to execute arbitrary commands on the server, posing a significant risk to system integrity. Organizations using affected versions should prioritize patching this vulnerability to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
UnoPim before 2.1.5 contains an authenticated file upload vulnerability that allows authenticated administrators to upload arbitrary PHP files through the TinyMCE image upload endpoint due to missing file extension and MIME type validation. Attackers can upload a PHP web shell to the public storage disk and execute arbitrary operating system commands on the server by accessing the uploaded file at the URL returned in the server response.