HAX CMS PHP allows you to manage your microsite universe with PHP backend. Multiple file upload functions within the HAX CMS PHP application call a ’save’ function in ’HAXCMSFile.php’. This save function uses a denylist to block specific file types from being uploaded to the server. This list is non-exhaustive and only blocks ’.php’, ’.sh’, ’.js’, and ’.css’ files. The existing logic causes the system to "fail open" rather than "fail closed." This vulnerability is fixed in 10.0.3.
The 'save' function in the 'HAXCMSFile.php' file blocks file uploads solely based on a denylist, which includes only the extensions '.php', '.sh', '.js' and '.css'. This list is incomplete and omits many other file types that can lead to server-side code execution. The system operates according to the 'fail open' principle, meaning in case of no match against the denylist it allows the upload instead of blocking it. An attacker with basic privileges can therefore upload an executable file with a different extension and execute it on the server.
An attacker can obtain remote code execution (RCE) on the server, leading to complete system takeover, confidential data leakage, and violation of application integrity and availability.
HAX CMS PHP should be updated to version 10.0.3, in which the vulnerability has been fixed. According to the description, the fix addresses replacing the denylist approach with more restrictive control of allowed file types (allowlist).
HAX CMS PHP (product Psu Haxcms-Php) — versions earlier than 10.0.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HPsu Haxcms PHP
APPPsu9.0.0 – 10.0.3 (bez)
Related vulnerabilities
HAX CMS allows you to manage your microsite universe with PHP or NodeJs backends. In versions 11.0.13 and belo...
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.3, the `...
HAX CMS PHP allows users to manage their microsite universe with a PHP backend. Prior to version 11.0.0, the a...
HAX CMS allows users to manage their microsite universe with a NodeJS or PHP backend. In haxcms-nodejs version...
haxcms-nodejs and haxcms-php are backends for HAXcms. The logout function within the application does not term...