| Название | saithink saiadmin 5.0.1 Remote Code Execution |
|---|
| Описание | SaiAdmin is a PHP-based backend management system built on the Webman framework, with Saipackage as its built-in plugin management module. This module contains a complete Remote Code Execution (RCE) attack chain involving three core vulnerabilities: the plugin upload endpoint lacks file type validation, allowing attackers to upload ZIP packages containing malicious PHP code; the plugin installation process has no code signature verification, enabling malicious files to be deployed directly to the webman/plugin/ directory and automatically loaded upon service restart; and the scheduled task system imposes no whitelist restriction on class names, allowing attackers to instantiate arbitrary PHP classes and invoke their methods. Combined, these form a complete attack chain: an attacker first deploys a malicious class containing shell_exec() to the server via the plugin upload interface, then triggers its execution through the scheduled task system, ultimately achieving arbitrary system command execution and full server compromise. Approximately 3,247 exposed assets have been identified on the public internet. |
|---|
| Источник | ⚠️ https://github.com/sign9981/CVE/issues/1 |
|---|
| Пользователь | xiaobu (UID 99226) |
|---|
| Представление | 24.06.2026 03:22 (2 месяцы назад) |
|---|
| Модерация | 09.08.2026 19:25 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 387276 [saithink/saigroup SaiAdmin до 5.0.1 Plugin Upload Endpoint upload shell_exec эскалация привилегий] |
|---|
| Баллы | 20 |
|---|