Attack Chain

1. Attacker authenticates to the Openupload backend with low-privilege credentials.
2. Attacker navigates to the Administration -> Plugins -> compress interface.
3. Attacker submits a POST request to 'index.php' with 'action=adminpluginsoptions', 'step=4', 'id=compress', and a malicious payload in the 'command' parameter.
4. The application saves the malicious command directive into the plugin configuration.
5. Attacker navigates to the File upload function.
6. Attacker initiates a file upload with the 'compress' parameter set to '0'.
7. The application executes the previously stored malicious command during the upload process.

Impact

Successful exploitation results in arbitrary command execution with the privileges of the web server user, leading to potential full system compromise, data theft, and manipulation.

Recommendation

• Identify and audit all instances of Openupload 0.4.3 within the environment.
• Apply security patches if available from the vendor; if the software is unmaintained, restrict administrative access to the backend to highly trusted internal subnets.
• Deploy the Sigma rules below to monitor for suspicious administrative plugin configuration changes and subsequent process execution from the web server.