A critical remote code execution vulnerability in UliCMS 2023.1 allows authenticated attackers to compromise the underlying server through malicious file uploads.

The application suffers from unrestricted file upload of a dangerous type (CWE-434) during the avatar update process. Authenticated attackers can bypass file type restrictions to upload .phar files, which subsequently enable arbitrary system command execution when accessed.

The ability for an attacker to execute arbitrary code on the server represents a total loss of system integrity and confidentiality. Given the high CVSS score of 8.8, this flaw poses a significant risk of data exfiltration, lateral movement, or complete server takeover, which could result in severe operational downtime and reputational harm.

Immediate Action: As no specific patch version is currently identified, administrators should restrict avatar upload permissions or disable the profile picture update functionality until an official security update is released by the vendor.

Proactive Monitoring: Review web server access logs for suspicious requests targeting the directory where avatar uploads are stored, particularly looking for requests ending in .phar or other executable extensions.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads containing executable extensions such as .phar, .php, or .phtml to prevent the delivery of malicious payloads.

Public Exploit Available: Yes, a public exploit exists via ExploitDB (Entry 51434).

Organizations utilizing UliCMS 2023.1 must treat this vulnerability with high urgency. Since the flaw allows for full system compromise, administrators should immediately restrict access to the avatar upload feature and monitor for unauthorized file uploads until a formal vendor patch is applied.