Syarif Mobile App Editor versions up to 1.3.1 are susceptible to an unrestricted file upload vulnerability, enabling attackers to deploy web shells and achieve remote code execution.

The application fails to properly validate the types of files uploaded, allowing an attacker to bypass restrictions and upload a malicious web shell to the web server.

Successful exploitation allows an attacker to gain persistent remote access to the underlying server environment. With a CVSS score of 9.1, this flaw presents a critical risk of data breach, unauthorized modification of application files, and complete loss of server confidentiality and integrity.

Immediate Action: Upgrade to the latest available version of Syarif Mobile App Editor that addresses this file upload restriction flaw.

Proactive Monitoring: Regularly scan the web server directory for unauthorized script files or unexpected changes to the file system.

Compensating Controls: Implement file extension and MIME type validation at the Web Application Firewall (WAF) level to block suspicious file uploads.

Public Exploit Available: Not specified

The risk associated with unrestricted file uploads is severe, as it provides a direct path to server compromise. Organizations should apply the necessary updates immediately and audit their file upload directories for existing indicators of compromise.