Authenticated attackers can achieve remote code execution on Serendipity 2.4.0 by uploading malicious PHP files via the media management interface.

This vulnerability is a CWE-434 flaw involving the unrestricted upload of files with dangerous types. An authenticated attacker can upload a file with a .phar extension containing malicious payloads to the media upload endpoint, which the server subsequently executes.

Successful exploitation allows an attacker to gain full control over the application server, potentially leading to complete data exfiltration, unauthorized modification of content, or the deployment of persistent malware. With a CVSS score of 8.8, this vulnerability represents a high risk to organizational security, as it grants attackers the ability to compromise the integrity and availability of the affected system.

Immediate Action: Restrict access to the media upload functionality to trusted users only and monitor the media library for suspicious file extensions like .phar, .php, or .phtml.

Proactive Monitoring: Review web server access logs for requests directed at the media upload endpoint that deviate from normal usage patterns, particularly those originating from unauthorized or unusual user accounts.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block file uploads containing sensitive extensions or suspicious content patterns, effectively preventing the delivery of malicious payloads.

Public Exploit Available: Yes, a published PoC exists, as documented in the ExploitDB entry (51372).

Given the high severity of this remote code execution flaw and the existence of a public proof-of-concept, administrators should prioritize the restriction of media upload capabilities. Organizations must audit all user accounts for suspicious activity and apply vendor-provided updates as soon as they become available to eliminate the underlying file validation deficiency.