| tiêu đề | saithink saiadmin 5.0.1 Remote Code Execution |
|---|
| Mô tả | SaiAdmin is a PHP-based backend management system built on the Webman framework, with Saipackage as its built-in plugin management module. This module contains a complete Remote Code Execution (RCE) attack chain involving three core vulnerabilities: the plugin upload endpoint lacks file type validation, allowing attackers to upload ZIP packages containing malicious PHP code; the plugin installation process has no code signature verification, enabling malicious files to be deployed directly to the webman/plugin/ directory and automatically loaded upon service restart; and the scheduled task system imposes no whitelist restriction on class names, allowing attackers to instantiate arbitrary PHP classes and invoke their methods. Combined, these form a complete attack chain: an attacker first deploys a malicious class containing shell_exec() to the server via the plugin upload interface, then triggers its execution through the scheduled task system, ultimately achieving arbitrary system command execution and full server compromise. Approximately 3,247 exposed assets have been identified on the public internet. |
|---|
| Nguồn | ⚠️ https://github.com/sign9981/CVE/issues/1 |
|---|
| Người dùng | xiaobu (UID 99226) |
|---|
| Đệ trình | 24/06/2026 03:22 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 09/08/2026 19:25 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 387276 [saithink/saigroup SaiAdmin đến 5.0.1 Plugin Upload Endpoint upload shell_exec nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|