Cloudanix VulnDB

CVE-2015-0258

High · 8.8

CVSS

8.8

EPSS

3.8%

Published

Feb 17, 2020

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in how user pictures are uploaded lets logged-in attackers place and run harmful code on the server.

Exploit Available
Exploitation
Remote Authenticated
Attacker needs
Low Privilege
Complexity
Low
Impact
Remote Code Execution
Component
Application
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Incomplete blacklist in avatar upload allows authenticated users to upload files with .php3, .php4, .php5, or .phtml extensions that are then executed as PHP code.

Why it matters to the business

Compromised servers can lead to full system takeover, data exposure, and operational disruption; the issue has been public for years with available exploits and affects a widely used admin interface component.

How an attack unfolds

An authenticated attacker navigates to the user management page, uploads a crafted avatar file using one of the permitted dangerous extensions containing malicious PHP, then directly requests the uploaded file path to trigger code execution on the server.

How to fix it

Upgrade pi-hole/adminlte (GIT) to commit b86e4a3178e46cef9fc738c6a0fb8d0ef0ff2fbc or later; enforce a strict allow-list of safe file extensions and store uploads outside the web root.

How to confirm the fix worked

Confirm the installed commit is b86e4a3178e46cef9fc738c6a0fb8d0ef0ff2fbc or newer; attempt upload of a test file with a blocked extension and verify it is rejected.

Typical attack path

  1. Obtain authenticated session in the application
  2. Access manageuser.php or equivalent avatar upload form
  3. Upload file with .php3/.php4/.php5/.phtml extension containing payload
  4. Locate or predict the stored file path on the server
  5. Request the uploaded file via HTTP to execute the payload

How to detect it

Search web server and application logs for HTTP POST requests to manageuser.php or avatar upload endpoints that contain filenames ending in .php3, .php4, .php5, or .phtml; inspect the upload directory for files with these extensions that were created after authentication events.

  • .php3
  • .php4
  • .php5
  • .phtml
  • manageuser.php

What your security team should do

  • Immediately update all instances of pi-hole/adminlte to the fixed commit
  • Add web application firewall rules to block requests containing the listed extensions in upload paths
  • Review server logs for prior uploads of .php3, .php4, .php5, or .phtml files
  • Implement runtime file type validation beyond extension checks

The record

Multiple incomplete blacklist vulnerabilities in the avatar upload functionality in manageuser.php in Collabtive before 2.1 allow remote authenticated users to execute arbitrary code by uploading a file with a (1) .php3, (2) .php4, (3) .php5, or (4) .phtml extension.

Affected packages

Ecosystem Package Introduced Fixed
Debian:8 collabtive 0 2.0+dfsg-5+deb8u1
Ubuntu:16.04:LTS collabtive 0 2.0+dfsg-6ubuntu1.1

Related vulnerabilities