Executive brief
Aero CMS, a content management system, contains a security flaw that allows registered users to take control of the web server. By uploading a malicious file disguised as an image when creating a post, an attacker can run unauthorized commands. This could lead to the theft of sensitive data, website defacement, or a total shutdown of the service.
Technical details
Aero CMS 0.0.1 is vulnerable to PHP code injection via the 'image' parameter in the administrative interface. An authenticated attacker can exploit this by navigating to the 'posts.php' endpoint with the 'source=add_post' parameter and uploading a PHP file containing malicious code instead of a standard image file. The application fails to properly validate the file type or content, allowing the uploaded script to be executed by the server. This results in arbitrary code execution (RCE) with the privileges of the web server user. As of the advisory date, there is no mention of a formal patch, though the software appears to be an older or unmaintained version.
Affected products
- MegaTKC Aero CMS 0.0.1
Timeline
- 2022-10-15: disclosed: Vulnerability discovered by Hubert Wojciechowski
- 2023-03-27: other: Exploit published on Exploit-DB
- 2026-05-10: advisory: NVD/VulnCheck advisory published