CyberRota Analysis
AI-GeneratedAn unrestricted file upload vulnerability in dulldusk/phpfm versions prior to 1.8.0 allows unauthenticated remote attackers to upload arbitrary PHP code, potentially leading to full server compromise. The lack of an upload extension filter and default authentication makes this a critical risk for any organization using this application. Users of dulldusk/phpfm should prioritize immediate remediation to mitigate the risk of unauthorized access and code execution.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An unrestricted file upload vulnerability in dulldusk/phpfm through 1.8.0 allows an unauthenticated remote attacker to execute arbitrary PHP code on the server. The application ships with an empty upload extension filter ( = array) and no authentication enabled by default (auth_pass is empty string), allowing an unauthenticated attacker to upload a PHP webshell and execute it by browsing to the uploaded path.