| tiêu đề | Feehi feehi cms 2.1.1 Unauthorized |
|---|
| Mô tả | FeehiCMS 2.1.1 is configured with 'assets/*' in the backend AccessControl allowActions whitelist (backend/config/main.php), making the UEditor file upload widget accessible without authentication. The UEditor widget exposes uploadImage, uploadFile (30+ extensions), catchImage, listImage/listFile and config actions to unauthenticated attackers. CSRF protection is also explicitly disabled in UeditorAction::init().
Root cause:
- backend/config/main.php: 'assets/*' in allowActions whitelist
- backend/widgets/ueditor/UeditorAction.php: enableCsrfValidation = false
- backend/widgets/ueditor/config.json: permissive fileAllowFiles list
- No MIME type validation, only extension check
Impact:
Unauthenticated attackers can upload arbitrary files (including .txt, .md, .xml, .zip), enumerate uploaded files, and host phishing/malware content.
Proof of Concept:
curl -X POST "http://TARGET:18080/admin/index.php?r=assets/ueditor&action=uploadfile" -F "[email protected]"
Remediation:
Remove 'assets/*' from allowActions, add authentication check, re-enable CSRF validation, restrict file types, add MIME validation.
References:
- https://github.com/liufee/cms
- https://github.com/liufee/cms/issues/94
- Full report: https://github.com/yang5ynag/cve/blob/main/FEHI-001-UEditor-Unauthorized-File-Upload.md
|
|---|
| Người dùng | lyang (UID 100042) |
|---|
| Đệ trình | 22/07/2026 08:20 (cách đây 2 các tháng) |
|---|
| Kiểm duyệt | 06/09/2026 10:59 (2 months later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 399396 [liufee FeehiCMS đến 2.1.1 UEditor Widget UeditorAction.php UeditorAction::init nâng cao đặc quyền] |
|---|
| điểm | 17 |
|---|