Schlix Cms — CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/schlix-cms/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 15 May 2026 19:19:56 +0000CVE-2021-47964: Schlix CMS Remote Code Execution via Malicious Extension Uploadhttps://feed.craftedsignal.io/briefs/2026-05-cve-2021-47964-schlix-rce/Fri, 15 May 2026 19:19:56 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-cve-2021-47964-schlix-rce/Schlix CMS 2.2.6-6 contains a remote code execution vulnerability, tracked as CVE-2021-47964, allowing authenticated attackers to execute arbitrary PHP code by uploading malicious extension packages through the block manager and triggering execution by accessing the 'About' tab.CVE-2021-47964 is a remote code execution (RCE) vulnerability affecting Schlix CMS version 2.2.6-6. This flaw allows authenticated attackers to inject and execute arbitrary PHP code on the target system. The attack vector involves uploading a malicious extension package disguised as a ZIP file via the block manager functionality. The injected PHP code, typically embedded within the packageinfo.inc file of the extension, is then executed when an administrator accesses the “About” tab of the newly installed extension. Exploitation grants the attacker the ability to execute commands on the web server, potentially leading to complete system compromise.

Attack Chain

  1. The attacker authenticates to the Schlix CMS application.
  2. The attacker navigates to the block manager interface within the CMS.
  3. The attacker crafts a malicious ZIP file containing a PHP file, commonly named packageinfo.inc, with the injected PHP code intended for execution.
  4. The attacker uploads the malicious ZIP file as a new extension through the block manager.
  5. The Schlix CMS processes the uploaded ZIP file and installs the “extension”.
  6. The attacker navigates to the “About” tab of the installed extension through the CMS interface.
  7. Accessing the “About” tab triggers the execution of the injected PHP code within the packageinfo.inc file.
  8. The attacker achieves remote code execution on the server, potentially leading to complete system compromise.

Impact

Successful exploitation of CVE-2021-47964 allows an authenticated attacker to execute arbitrary PHP code on the affected Schlix CMS server. This can lead to complete system compromise, data theft, website defacement, or further lateral movement within the network. Given the ease of exploitation and the severity of the impact, organizations using Schlix CMS 2.2.6-6 are at significant risk.

Recommendation

  • Upgrade to a patched version of Schlix CMS that addresses CVE-2021-47964, if available.
  • Deploy the Sigma rule “Detect CVE-2021-47964 Exploitation — Malicious Extension Upload” to detect attempts to upload malicious ZIP files containing PHP code via the block manager.
  • Monitor web server logs for POST requests to the block manager interface (/admin/) with suspicious ZIP file uploads, as indicated in the Sigma rule.
  • Implement strict access control policies to limit who can upload and install extensions within the Schlix CMS environment.
]]>criticaladvisoryCVE-2021-47964rceschlix cmsphp