CVE-2023-33601 in PHPOK
Summary
by MITRE • 06/07/2023
A vulnerability, which was classified as problematic, was found in PHPOK 6.4.100. This affects an unknown part of the file /admin.php?c=upload&f=zip&_noCache=0.1683794968. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The identifier VDB-229953 was assigned to this vulnerability.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/27/2026
This vulnerability in PHPOK 6.4.100 represents a critical security flaw that allows unauthorized file uploads through the administrative interface. The affected component resides in the /admin.php?c=upload&f=zip&_noCache=01683794968 endpoint, which processes zip file uploads without proper validation mechanisms. This unrestricted upload capability enables attackers to bypass normal security controls and potentially execute malicious code within the application's environment.
The technical implementation of this vulnerability stems from inadequate input validation and access control measures within the file upload functionality. Attackers can exploit this weakness by crafting specially formatted zip archives that contain malicious payloads, including web shells or other harmful executables. The vulnerability operates at the application layer and specifically targets the content management system's administrative upload handlers, making it particularly dangerous given the elevated privileges typically associated with admin interfaces.
From an operational perspective, this vulnerability poses significant risks to organizations using PHPOK 6.4.100 as their content management platform. Remote exploitation allows attackers to gain persistent access to systems through uploaded malicious files, potentially leading to complete system compromise. The vulnerability's classification as remotely exploitable means that no local access or authentication is required for successful attack execution, making it an attractive target for automated exploit campaigns.
The impact extends beyond immediate code execution capabilities to encompass potential data breaches, service disruption, and lateral movement within network environments. Security frameworks such as CWE-434 specifically address unrestricted file upload vulnerabilities, categorizing them under the broader class of insecure file handling practices that can lead to arbitrary code execution. This vulnerability aligns with ATT&CK technique T1505.003 for "Download and Execute" operations and may support subsequent techniques for privilege escalation and persistence.
Organizations should immediately implement mitigations including input validation, file type restrictions, and proper access controls around administrative endpoints. The recommended approach involves implementing strict file extension filtering, content verification mechanisms, and ensuring that uploaded files are stored outside the web root directory. Additionally, network-level protections such as web application firewalls and intrusion detection systems can provide additional layers of defense against exploitation attempts targeting this specific vulnerability.