Subrion CMS: file upload to RCE (CVE-2018-19422)

Subrion CMS 4.2.1 (and earlier) suffers from an authenticated file upload that leads to code execution (CVE-2018-19422). The admin panel's file manager tries to prevent script uploads with a blacklist of extensions (.php, .phtml, etc.), but the check is incomplete: it misses extensions the server also executes as PHP, in particular .phar.

A .phar (PHP Archive) is interpreted by PHP just like a .php when Apache is configured to route files with that extension through the engine. Since the filter doesn't block it, you can upload a .phar webshell to the panel's uploads directory and run it from the public URL:

searchsploit 'subrion cms 4.2'
searchsploit -m php/webapps/49876.py
python subrioncms_exp.py -u http://<host>/panel/ -l admin -p admin
# -> webshell at http://<host>/panel/uploads/<rand>.phar

The public exploit automates the full flow: it grabs the CSRF token, logs in (often with default credentials admin/admin), uploads the randomly named webshell and returns a console. Execution is as the web server user (www-data), a typical starting point to escalate afterward.

It belongs to the file-upload RCE family: the flaw isn't "being able to upload", but that extension validation is an evadable blacklist and the uploads directory is executable.

How to detect it. The log shows a login at /panel/ (often with admin/admin) followed by a POST to the file manager uploading a .phar, then a request to /panel/uploads/<rand>.phar returning command output instead of a data file. A .phar (or any extension executed as PHP) appearing in uploads/ is the on-disk signature (FIM), and the web process spawning sh/bash as a child confirms execution. The file's random name, typical of the public exploit, is an additional clue.

Defence. Update Subrion; validate by real type with a strict allowlist; store uploads outside the docroot or in a directory with PHP execution disabled; and change the panel's default credentials.