Product
CI4MS Backup Restore Zip Slip Vulnerability Leads to RCE
2 rules 2 TTPsThe CI4MS Backup restore function is vulnerable to Zip Slip, allowing remote code execution by uploading a malicious ZIP archive that writes PHP files to the public web root due to missing validation of entry names during extraction, affecting versions prior to 0.31.5.0.
CI4MS Authenticated Remote Code Execution via Theme Upload
2 rules 2 TTPsCI4MS versions 0.26.0.0 through 0.31.6.0 are vulnerable to remote code execution; an authenticated backend user with theme upload permissions can upload a crafted ZIP file containing a PHP file, which is then installed into the web-accessible public directory without filtering, allowing direct execution via HTTP.
CI4MS Theme Upload Zip Slip Vulnerability
2 rules 2 TTPsA critical vulnerability exists in ci4ms Theme::upload, where improper validation of ZIP archive entry names allows authenticated users with theme creation permissions to write files to arbitrary locations, leading to remote code execution.