A critical remote code execution vulnerability in H-ui.admin allows unauthenticated attackers to gain full control over the web server.

The vulnerability resides in the /lib/webuploader/0.1.5/server/preview.php file, which lacks necessary authentication and file type validation. This flaw permits unauthenticated remote attackers to upload malicious PHP scripts, resulting in arbitrary code execution with the privileges of the web server.

Successful exploitation allows an attacker to execute arbitrary code on the underlying server, leading to a complete compromise of the application and its data. Given the CVSS score of 7.3, this represents a significant risk to confidentiality, integrity, and availability, potentially facilitating lateral movement within the network or the exfiltration of sensitive information.

Immediate Action: As no official patch is currently available, administrators should immediately restrict access to the /lib/webuploader/ directory or disable the WebUploader component entirely if it is not business-critical.

Proactive Monitoring: Review web server access logs for anomalous POST requests directed at /lib/webuploader/0.1.5/server/preview.php, particularly those containing base64 encoded payloads or unusual file extensions.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the vulnerable preview.php endpoint and inspect incoming traffic for attempts to upload files with executable extensions like .php.

Public Exploit Available: Yes, a functional proof-of-concept exists as documented in the linked research write-up by the vulnerability reporter.

The absence of a vendor-provided patch necessitates immediate manual intervention to protect the environment. Organizations using H-ui.admin versions 3.0 or 3.1 must prioritize implementing the suggested compensating controls and access restrictions to prevent potential remote code execution attacks.