Attack Chain

1. The attacker authenticates to the UnoPim administrative dashboard using valid or compromised credentials.
2. The attacker navigates to the TinyMCE image upload feature within the application interface.
3. The attacker crafts a request to the TinyMCE image upload endpoint containing a malicious PHP file payload.
4. The UnoPim server receives the file and fails to perform server-side validation of the 'extension' or 'MIME type' attributes.
5. The server stores the malicious PHP file within a public-facing directory on the web server storage disk.
6. The application returns the URL path of the uploaded file to the attacker in an HTTP response.
7. The attacker sends an HTTP GET request to the path of the uploaded PHP file.
8. The web server executes the PHP code, enabling command execution or persistent backdoor access.

Impact

Successful exploitation allows for full remote code execution on the server hosting the UnoPim instance. As the vulnerability requires administrative access, it is typically used for lateral movement or persistence after an initial account compromise. The impact includes potential full system compromise, data exfiltration from the database or storage, and the ability to pivot to other internal network resources.

Recommendation

1. Upgrade UnoPim to version 2.1.5 or later immediately to incorporate necessary file validation logic.
2. Monitor web server logs for HTTP POST requests to the TinyMCE image upload endpoint that contain unusual file extensions (e.g., .php, .phtml, .php7).
3. Restrict administrative access to the UnoPim dashboard to known-trusted management IP addresses.
4. Audit the public storage directory for unauthorized script files that do not match expected image file formats.