When the application passes these unsanitized entries to the PHP ZipArchive::extractTo() function, it performs file operations outside of the intended extraction directory. This allows an attacker to overwrite existing files or write new files to arbitrary locations on the host filesystem. By targeting the web-accessible public directory, an attacker can upload malicious PHP scripts to achieve remote code execution (RCE). This vulnerability represents a significant risk to hosted environments where attackers may already possess low-privileged administrative access.

Impact

Successful exploitation allows authenticated attackers to achieve remote code execution on the underlying server. This could lead to full system compromise, unauthorized access to sensitive financial data stored within the application, and potential lateral movement into the hosting environment.

Recommendation

• Upgrade Crater Invoice to a patched version beyond 6.0.6 as soon as it becomes available.
• Until patching is possible, restrict access to the self-update API or disable the module entirely if not required for standard operations.
• Monitor web server logs for suspicious POST requests to the self-update/unzip endpoints, specifically looking for anomalous request parameters or file upload patterns.
• Audit the web-accessible directories of the application for unexpected PHP files created during the update or management process.