| 제목 | saithink saiadmin 5.0.1 Remote Code Execution |
|---|
| 설명 | SaiAdmin is a PHP-based backend management system built on the Webman framework, with Saipackage as its built-in plugin management module. This module contains a complete Remote Code Execution (RCE) attack chain involving three core vulnerabilities: the plugin upload endpoint lacks file type validation, allowing attackers to upload ZIP packages containing malicious PHP code; the plugin installation process has no code signature verification, enabling malicious files to be deployed directly to the webman/plugin/ directory and automatically loaded upon service restart; and the scheduled task system imposes no whitelist restriction on class names, allowing attackers to instantiate arbitrary PHP classes and invoke their methods. Combined, these form a complete attack chain: an attacker first deploys a malicious class containing shell_exec() to the server via the plugin upload interface, then triggers its execution through the scheduled task system, ultimately achieving arbitrary system command execution and full server compromise. Approximately 3,247 exposed assets have been identified on the public internet. |
|---|
| 원천 | ⚠️ https://github.com/sign9981/CVE/issues/1 |
|---|
| 사용자 | xiaobu (UID 99226) |
|---|
| 제출 | 2026. 06. 24. AM 03:22 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 09. PM 07:25 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 387276 [saithink/saigroup SaiAdmin 까지 5.0.1 Plugin Upload Endpoint upload shell_exec 권한 상승] |
|---|
| 포인트들 | 20 |
|---|