A critical arbitrary file upload vulnerability in Feng Office 3.11.13.11 allows unauthenticated remote attackers to execute malicious files, posing a severe risk of complete system compromise.

This is an unauthenticated arbitrary file upload vulnerability located in the ck_upload_handler.php script. Attackers can bypass authentication to upload arbitrary files, such as HTML or script files, into the web-accessible /tmp/ directory, which may lead to remote code execution.

The vulnerability carries a CVSS score of 9.8, indicating a critical severity level. Successful exploitation allows an unauthenticated attacker to gain unauthorized access to the web server, potentially leading to full system compromise, data theft, and the hosting of malicious content on the affected infrastructure.

Immediate Action: As no specific patch version is currently confirmed, administrators should restrict network access to the /tmp/ directory and the ck_upload_handler.php file, or disable the affected upload functionality until a vendor patch is released.

Proactive Monitoring: Review web server access logs for requests targeting ck_upload_handler.php, particularly those originating from unknown or unauthorized IP addresses, and monitor the /tmp/ directory for unexpected file creations.

Compensating Controls: Deploy a Web Application Firewall (WAF) rule to block unauthorized access to the ck_upload_handler.php endpoint and inspect incoming POST requests for suspicious file extensions or content types.

Public Exploit Available: Yes, a public proof-of-concept exists as referenced in the GitHub repository provided by the CVE enrichment data.

Given the critical nature of this vulnerability and the existence of a public proof-of-concept, organizations using Feng Office 3.11.13.11 must prioritize the immediate implementation of compensating controls. Monitor for vendor security bulletins closely to apply the necessary security update the moment it becomes available to prevent potential unauthorized access.