| عنوان | saithink saiadmin 5.0.1 Remote Code Execution |
|---|
| الوصف | SaiAdmin is a PHP-based backend management system built on the Webman framework, with Saipackage as its built-in plugin management module. This module contains a complete Remote Code Execution (RCE) attack chain involving three core vulnerabilities: the plugin upload endpoint lacks file type validation, allowing attackers to upload ZIP packages containing malicious PHP code; the plugin installation process has no code signature verification, enabling malicious files to be deployed directly to the webman/plugin/ directory and automatically loaded upon service restart; and the scheduled task system imposes no whitelist restriction on class names, allowing attackers to instantiate arbitrary PHP classes and invoke their methods. Combined, these form a complete attack chain: an attacker first deploys a malicious class containing shell_exec() to the server via the plugin upload interface, then triggers its execution through the scheduled task system, ultimately achieving arbitrary system command execution and full server compromise. Approximately 3,247 exposed assets have been identified on the public internet. |
|---|
| المصدر | ⚠️ https://github.com/sign9981/CVE/issues/1 |
|---|
| المستخدم | xiaobu (UID 99226) |
|---|
| ارسال | 24/06/2026 03:22 AM (2 أشهر منذ) |
|---|
| الاعتدال | 09/08/2026 07:25 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 387276 [saithink/saigroup SaiAdmin حتى 5.0.1 Plugin Upload Endpoint upload shell_exec تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|