Attack Chain

1. An attacker identifies an internet-facing i-doit Pro admin-center interface.
2. The attacker initiates a brute-force or credential-guessing attack against the default 'admin' account due to lack of enforced password complexity.
3. Upon successful authentication, the attacker navigates to the 'Add-on' section within the admin-center.
4. The attacker uploads a legitimate plugin archive and extracts the contents locally.
5. The attacker modifies the 'init.php' file within the plugin to include a reverse shell or other arbitrary command execution payload, ensuring the process is backgrounded to prevent application crashes.
6. The attacker re-archives the modified plugin folder as a ZIP file.
7. The attacker uploads the malicious plugin via the 'Upload' function in the admin-center.
8. The attacker activates the plugin; the payload executes when the system processes the 'init.php' file, resulting in remote code execution.

Impact

Successful exploitation allows unauthenticated attackers to gain full administrative control over the i-doit Pro environment. This results in potential unauthorized access to sensitive IT infrastructure documentation, full system compromise, and the ability to execute arbitrary code on the underlying web server, likely leading to data exfiltration or lateral movement within the network.

Recommendation

1. Immediately restrict access to the i-doit Pro admin-center to trusted management networks using firewall rules.
2. Enforce strong password complexity policies for all administrative accounts, specifically targeting the 'admin' account, as the default configuration may permit trivial passwords.
3. Audit existing plugins for unauthorized modifications by verifying the file integrity of 'init.php' and other executable components against known-good baselines.
4. Monitor web server logs for suspicious POST requests to the plugin upload endpoint and repeated failed login attempts to the admin-center.